Identity verification breach exposes millions of driver’s licenses, including Defense Secretary’s ID

A new illicit service called Nexus, advertised on a Russian cybercrime forum, is offering more than 153 million scanned U.S. and Canadian driver’s licenses, along with millions of other identification documents. Among the listings is a digital scan of Defense Secretary Pete Hegseth’s driver’s license.

Cybersecurity researcher Brian Krebs reported that Nexus also provides ID cards, travel documents, medical IDs and other credentials such as marijuana dispensary cards and commercial driver’s licenses. The operators claim the data are being continuously exfiltrated from an ongoing breach at a major identity-verification firm.

“We have been continuously exfiltrating new data for over a year into our private database,” the group wrote in a forum post.

Krebs’ analysis points to IDscan.net, a Mexican company with a U.S. office in New Orleans, as the likely source of the compromised records. The company said it is investigating the incident, with marketing and operations leader Jillian Kossman noting that the information provided by Krebs has been helpful to their team.

The FBI opened an investigation into Nexus on the same day Krebs disclosed the service. Shortly after the report, the Nexus website went offline and now displays a notice that the service is no longer available.

Authorities warn that the stolen data could facilitate identity theft, enable tracking of domestic-abuse victims or individuals in witness-protection programs, and pose national-security concerns given the ease of linking high-profile individuals to publicly available facial-recognition tools.