IDScan hack exposes 153 million driver's licenses

More than 153 million digital scans of U.S. and Canadian driver’s licenses have been leaked to the dark web in what cybersecurity experts call one of the biggest identity-data breaches in recent years. The haul includes scans from people across both countries and appears to have originated with a Louisiana-based ID verification company called IDScan. The FBI confirmed on Tuesday it has opened an investigation into the breach after cybersecurity journalist Brian Krebs confirmed the authenticity of samples provided by the hackers, including a copy of his own license.

The stolen data surfaced on Nexus, a dark-web marketplace that briefly offered scans of licenses, medical cards, employment records, and residence cards for sale. Krebs traced the leak to IDScan, a company whose clients include Hertz, Target, FedEx, Motorola, and Jack Henry. Many victims have one thing in common: they recently rented a car from Hertz, which uses IDScan for digital ID verification. Krebs said the market listing used his license as a free sample to attract buyers before the site shut down.

The FBI’s New Orleans field office is leading the probe, and multiple victims have verified that their own license scans were accurate. The breach raises concerns about the security of third-party verification services, which handle sensitive identity documents for major corporations and government agencies. Krebs also noted that the hackers showed him a scan of U.S. Secretary of Defense Pete Hegseth’s license, underscoring the breadth and sensitivity of the exposed data.

While Nexus is now offline, the leaked scans remain in circulation on the dark web. This incident mirrors past breaches, such as the 2023 hack of a Discord third-party provider that exposed 70,000 government IDs. Security experts warn that once such data is leaked, it can be used for years in identity theft, fraud, and targeted scams. The IDScan breach highlights the risks of relying on outside vendors for ID verification and the need for stronger safeguards to prevent mass leaks of biometric and personal data.