More than 153 million scans of US and Canadian driver's licenses were leaked to the dark web, according to cybersecurity journalist Brian Krebs. The source is believed to be an ID verification service in Louisiana, though the FBI has opened an investigation. A service called Nexus went live to sell these documents and many others, which included medical cards, employment records and residence cards.

Krebs confirmed the authenticity of these documents by interacting with the cybercriminals, who provided him with a scan of his own license. Other victims have confirmed their scans were correct. Incidentally, the hackers also showed Krebs a scan of Secretary of Defense Pete Hegseth's driver's license.

Brian Krebs learned about the database because someone tipped him off that his ID was being used as the free sample to advertise it. Many of the victims have one thing in common: they rented a car from Hertz, which uses IDScan for verification purposes. The company's client list also includes Target, Fed Ex, Motorola and Jack Henry.

The FBI seems to confirm Krebs' claims, as the New Orleans field office launched the investigation. The Nexus "service" was originally advertised on a Russian cybercrime forum called Exploit which used Krebs' license as a free sample to lure in customers. Nexus has since shuttered and the login page announces that the platform is no longer available.

A similar data breach impacted Discord after its third-party service provider was hacked. This led to the exposure of more than 70,000 government IDs.