FBI investigates alleged IDScan.net breach exposing over 150M driver licenses
The FBI is investigating an alleged data breach at identity verification firm IDScan.net after dark-web service Nexus reportedly offered over 150 million U.S. and Canadian driver licenses for sale, including one belonging to U.S. Secretary of War Pete Hegseth. KrebsOnSecurity first reported the apparent leak, which is also described as involving 153 million records.
If confirmed, this would be one of the largest identity data breaches on record, exposing millions of drivers' sensitive personal information to potential identity theft and fraud. The alleged breach also puts major Fortune 500 companies and institutions that rely on IDScan.net at risk and raises broader concerns about the security of third-party identity verification services.
Security researcher vx-underground published a list of IDScan.net clients that may be affected, including Shell, DraftKings, FedEx, Hertz, General Motors, Caesars Entertainment, and Motorola. Privacy researcher Zach Edwards said his ID was leaked after visiting Planet13, a Las Vegas cannabis dispensary, and that signs point to an ongoing real-time breach at IDScan.net; Nexus claims it has been continuously exfiltrating data for over a year but its service is currently unavailable.
gdelt · americanbazaaronline.com · · 2 sources
Background, discussion, and references
Background
IDScan.net is an identity verification company whose scanning services help businesses validate government-issued IDs such as driver licenses. Driver licenses contain highly sensitive personal data, including name, date of birth, address, and license number, making them valuable targets for cybercriminals who sell stolen records on dark-web platforms like Nexus. Because the alleged breach touches clients across industries such as fuel retail, gaming, banking, and casinos, the potential harm extends beyond individual consumers to the businesses that relied on the verification process.
Tags
#data-breach#FBI#driver-licenses#privacy#identity-theft