Last week, Krebs on Security revealed a dark web service called Nexus selling access to identity documents, including 3 million travel documents and 153 million driver's licenses from U.S. and Canadian citizens. Nexus claimed it had breached a major identity verification company and spent over a year exfiltrating data. In one day, licenses increased by nearly 400,000. Krebs verified the licenses were genuine, including those of Pete Hegseth and an FBI assistant director. He linked the breach to IDScan, which is investigating. The FBI is also looking into it.

Such data can facilitate identity theft and phishing, but also has national security implications. Intelligence agencies value licenses because they link to other databases with home addresses and photos. In the mid-2010s, Chinese APT groups stole data from Anthem, Equifax, Marriott, United Airlines, and the Office of Personnel Management, which was used to counter U.S. intelligence.

Bellingcat has shown how similar data can uncover covert activity, such as identifying a deep cover GRU agent in Naples and suspects in the Skripal assassination. Leaked databases are incredibly useful for investigations.