Circuit Wire — a daily news update from the Circuit.
A dark-web identity service called Nexus advertised more than 153 million U.S. and Canadian driver's license scans for sale, and the FBI has opened an investigation. The listing, first reported by security journalist Brian Krebs on September 1, also offered 10 million ID cards, 3 million travel documents and 579,000 medical cards. Krebs said he confirmed the data by searching it for his own records and those of others who had agreed to the checks, then traced it to IDScan, an identity-verification firm based in Louisiana.
IDScan sells hardware and software that businesses use to scan and authenticate government IDs. Its systems run in car rental firms, retailers, gun shops, banks, cannabis dispensaries and hospitality venues across the United States. Each scan captures the face of an ID, including the holder's name, home address, date of birth, license number and photo. That reach helps explain how one vendor could hold identity records on a scale that rivals the largest breaches on record.
The exposed documents reportedly include the driver's license of Defense Secretary Pete Hegseth and an assistant director of the FBI, according to BleepingComputer, which said it could not independently confirm those specific records. Reuters reported that the FBI's New Orleans field office is examining the case, and the bureau has confirmed the investigation while declining further comment.
IDScan has not addressed the allegations publicly, and it has not said whether its systems were breached or how many people are affected. The company began notifying some business customers around September 1, according to the law firm Markovits, Stock and DeMarco. Several firms have filed lawsuits in Louisiana, where IDScan is based, arguing that it failed to protect data collected for clients such as the car rental company Hertz.
The Nexus service is now offline, though criminals still hold the stolen database. Large identity exposures have drawn state and federal action before, including cases against 23andMe, Marriott and Equifax. Verified government IDs are prized for fraud and account takeover, and the reported presence of a cabinet member's license shows how far a single vendor's data can reach.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.