In what has to be one of the biggest data breaches to date, a security researcher discovered a hacker who appeared to be selling access to a database of over 153 million driver's licenses from the United States and Canada, including IDs for Pete Hegseth, the current U.S. Defense Secretary (the Defense Department is reportedly aware and investigating).
The breach was spotted by security journalist Brian Krebs in a report claiming that the hacker created a site called Nexus and claimed to have access to digital scans of 153,347,439 identity cards.
"A quick look around Nexus finds they are likely not exaggerating about that 153 million number: Running a blank search in Nexus (with no search parameters entered) returns approximately 11.5 million pages of results, with roughly 15 results displayed per page," Krebs wrote.
In a forum post from a Russian cybercrime site, Nexus allegedly sourced the scans from "major identity verification company," suggesting that the hackers had or have basically real-time access to the company's systems.
How it happened
Krebs found his own driver's license was among the searchable records. He also found Hegseth, whose photo was listed on the site.
Krebs worked with security researcher Zach Edwards, whose ID was also in the breach, and identified the company IDScan as the potential source of the leak. The company, based out of Louisiana, is used by multiple companies to verify millions of IDs from around the globe.
"Based on all the details in the article and how Brian was literally able to dox me (and the timing of the screenshot of my license being added into the system aligning to my trip), all the signs point to IDscan having a hellacious ongoing real-time breach of their data. This is a massive vendor," Edwards wrote on Bluesky.
Investigations and concerns
Per Krebs, the FBI and IDScan are both investigating the breach. Tom's Guide reached out to both organizations but did not receive a reply in time for posting.
“At this point I’m not able to share any additional information, but the updates you have provided have been welcome and helpful to our team’s investigation,” an IDScan spokesperson told Krebs.
A commenter on Krebs story claims that his company received a data breach notification from IDscan:
"Earlier today, September 1, we received information suggesting that certain information may have been exposed and that IDScan.net may be implicated. We are working urgently to validate that information and determine whether any unauthorized access occurred, and the scope of such activity," the note reportedly reads.
It goes on to say that the company has taken steps to secure its system, notified partner companies, engaged legal counsel, and is conducting a third-party forensic investigation.
Nexus apparently went down shortly after Krebs' report went live. Though it's possible it could return under a different domain.
A data breach like this is terrifying at the best of times, but it happens to come at a time just as governments across the globe are attempting to roll out age-verification laws that require adults to upload or scan identity documents in order to prove they can access websites or apps — generally adult content. Privacy advocates and security researchers have already warned that the laws put people's data at risk.
How to stay safe
Edwards ID was likely scanned when he went to a cannabis dispensary that has a contract with IDScan. Krebs believes his was scanned when he rented a car from Hertz last year. He also found his mom's ID from around the same time.
There are plenty of places where your ID could get scanned, from car rental agencies to bars and even the TSA. In the meantime, I would suggest requesting that your ID not be scanned by companies that demand it during check out or check in.
While we don't know if the Nexus database will return, it would be good form to take these seven steps to stay safe after a data breach.
That includes signing up for one best identity theft protection services. As always, you'll want to be on high alert for phishing attacks and social engineering attacks, especially ones that urge you to "act now." Avoid clicking on any links, QR codes, or attachments from unknown senders.
Beyond that, you should consider a password overhaul by creating strong, complex passwords for all of your accounts but you can also use one of the best password managers to do so for you instead.
Even without a massive data breach, these are generally good practices just to keep your side of the street clean since companies are increasingly unable to do so.
Follow Tom's Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds.
More from Tom's Guide
- More than 9.5 million patient records affected by Aesto Health data breach: what you need to know
- We put the best identity theft protection to the test to protect your entire digital life — these are the services I recommend
- Have you been 'Flocked'? Here's how to look up automatic license plate readers in your area
