More than 153 million scans of US and Canadian driver's licences, along with medical cards, employment records and residence documents, were put up for sale on the dark web through a service called Nexus, according to cybersecurity journalist Brian Krebs. The breach is significant both for its scale and because it appears to stem from a single compromised verification provider used by major companies, raising fresh concerns about how widely personal identity documents are shared and stored by third parties. Krebs discovered the leak after being tipped off that his own licence was being used as a free sample to promote the database, which he later verified as genuine along with confirmations from other affected individuals.

Krebs has linked the likely source to a hack of IDScan, a Louisiana-based identity verification firm whose clients include Hertz, Target, FedEx, Motorola and Jack Henry; many victims appear to have had their details captured while renting cars from Hertz. The FBI's New Orleans field office has opened an investigation, lending weight to Krebs's findings. The documents were originally advertised on a Russian cybercrime forum called Exploit, and included a scan of US Defense Secretary Pete Hegseth's licence. The Nexus platform has since gone offline, though the leaked data is believed to still be circulating. It follows a similar incident at Discord, where a third-party provider breach exposed more than 70,000 government IDs.