FBI investigates leak of 153 million US driver licenses on Russian cybercrime forum

September 10, 2026 at 11:55 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

The FBI is investigating a leak of 153 million US driver's licenses shared on the Russian cybercrime forum Exploit. The data, traced to Louisiana-based identity verification firm IDScan, includes the license of US Secretary of Defense Pete Hegseth. The leak was identified by security researcher Brian Krebs, who found his own data in the collection.

Key Facts

The leaked archive contains 153 million US driver's licenses and 1.1 million Canadian driver's licenses.
US Secretary of Defense Pete Hegseth's driver's license is among the leaked records.
The data was traced to IDScan, a Louisiana-based identity verification company used by FedEx and Hertz.
The data was shared on the Russian cybercrime forum Exploit by a service called Nexus.
Security researcher Brian Krebs was alerted to the data on August 31, 2026, and the dataset grew by nearly 400,000 records before his September 1 publication.

The Leak

A data leak of 153 million US driver's licenses was shared on the Russian cybercrime forum Exploit. The data was traced to IDScan, a Louisiana-based identity verification company that serves FedEx and Hertz. Security researcher Brian Krebs identified the leak and found his own driver's license and that of his mother in the collection. Both licenses were used for a car rental with Hertz, which Krebs traced back to IDScan's verification process.

Data Contents

The archive also includes 1.1 million Canadian driver's licenses, 10 million identification cards, 3 million travel documents and international IDs, and 579,000 medical cards. The data was available to browse, with Nexus providing previews of records with pertinent information redacted and customer photos displayed if available. US Secretary of Defense Pete Hegseth's driver's license is among the leaked records.

Investigation and Aftermath

The FBI is investigating the leak. Krebs was alerted to the data on August 31, 2026, and the dataset grew by nearly 400,000 records before his September 1 publication. Following news of the leak, the identity theft service Nexus apparently scrubbed its existence from the Dark Web. IDScan, which claims to perform 21 million verifications a month, has not issued a statement; its marketing and operations leader Jillian Kossman said she could not share additional information.