FBI probes dark-web leak of 153M driver's licenses linked to IDScan.net

Key points

• Over 153 million driver's licenses from the U.S. and Canada were found for sale on the dark web via a service called Nexus.
• The data includes 10 million identification cards, 3 million travel documents, and 579,000 medical cards, with some records showing infrared and ultraviolet scans.
• The FBI's New Orleans field office confirmed it is investigating the incident, which may be the largest exposure of government-issued identity documentation.
• IDScan.net, a Louisiana-based identity verification provider, is suspected as the source, with clients including Hertz and over 1,900 marijuana dispensaries.
• The Nexus service disappeared shortly after the breach was reported, but the data appears to have been growing by hundreds of thousands of records daily.

Background

This incident follows earlier reports in September 2026 about a dark-web leak of driver's licenses, which were initially attributed to a breach at a major identity verification company. The current investigation by the FBI's New Orleans field office is a direct response to the scale and nature of the data exposed, which includes high-resolution scans that could facilitate identity theft and fraud.

How outlets are covering it

KrebsOnSecurity and Ars Technica emphasize the real-time nature of the breach, with licenses appearing for sale within hours of being scanned at rental companies or dispensaries. NBC News highlights the inclusion of Defense Secretary Pete Hegseth's license, underscoring the national security implications. WSB-TV focuses on the FBI's investigation and the potential risks to high-profile individuals. All sources agree on the scale of the breach but differ in emphasis: Krebs and Ars Technica focus on the technical details and the source (IDScan.net), while NBC and WSB-TV highlight the political and security ramifications.

Why it matters

This breach poses significant risks to identity theft and fraud, as the high-resolution scans include infrared and ultraviolet data that could be used to create counterfeit IDs. The involvement of a major identity verification provider like IDScan.net, which serves numerous Fortune 500 companies and marijuana dispensaries, highlights vulnerabilities in third-party data handling. The ongoing nature of the breach suggests that the data is still being exfiltrated, posing a continuous threat to individuals and national security.

What to watch

The FBI is expected to continue its investigation into the source of the breach, with IDScan.net also conducting its own inquiry. The disappearance of the Nexus service may hinder efforts to trace the data's origin, but the ongoing nature of the breach suggests that more data may still be at risk. Individuals are advised to monitor their credit and report any fraud to the FTC or their local DMV.