Pete Hegseth's Driver's Licence Listed for $100 on Dark Web Among 153M+ IDs in Huge Data Leak

A dark web identity-theft service reportedly listed a scan of US Defense Secretary Pete Hegseth's driver's licence for sale as part of a massive cache of more than 153 million North American licence records.

The service, called Nexus, claimed to be selling digital scans of driver's licences from the United States and Canada, according to cybersecurity journalist Brian Krebs of KrebsOnSecurity.

Krebs reported that one record available on the marketplace included Hegseth's driver's licence and was listed for $100 (£74.16). He also said the service had advertised his own Virginia licence as a free sample on a Russian cybercrime forum. The records reportedly included multiple images of each licence, including front and back scans, as well as infrared and ultraviolet versions.

153 Million Licence Scans Claimed

Nexus claimed to hold more than 153 million driver's licences, 10 million ID cards, three million international travel or ID documents, and 579,000 medical cards. Krebs said the service appeared unlikely to be exaggerating, noting that a blank search returned roughly 11.5 million pages of results, with about 15 records on each page.

The number of driver's licence records reportedly grew by almost 400,000 in 24 hours, while Nexus operators claimed they had been exfiltrating new data for more than a year. The marketplace was later said to have gone offline, displaying only a message that it was no longer available.

Evidence Points to IDScan.net

The suspected source of the data is IDScan.net, a Louisiana-based identity verification company used by businesses to scan and authenticate IDs in person and online. Krebs reported that timestamps attached to licence images matched dates when victims had used services such as car rentals and other identity-check locations.

IDScan.net's own website says its VeriScan platform is used for ID fraud prevention, age verification, access management and visitor management. The company says it verifies millions of IDs and identities every month and serves thousands of businesses.

Its public materials and trust pages list major brands including Hertz, FedEx and Target, while IDScan.net also says its products are used by cannabis dispensaries and age-restricted businesses.

IDScan.net's Response on Breach

IDScan.net has not publicly confirmed the scale or nature of any breach. Krebs reported that the company said it was investigating, but had not provided a substantive response to detailed questions. A message cited by Cybernews said IDScan.net was working to validate information about a possible security incident and determine whether unauthorised access occurred.

The FBI's New Orleans field office has opened an official inquiry into the apparent breach involving IDScan.net, Krebs reported.

A driver's licence scan is not just a picture of a card. It can include a person's name, address, date of birth, signature, licence number and face photo. That makes the reported leak especially dangerous for identity theft, fraud, account takeovers and attempts to bypass identity checks.

The risk is even higher because the exposed records reportedly include government officials, public figures and ordinary customers who may have simply rented a car, entered a dispensary or had their ID scanned at a business.

The full scope remains unconfirmed. But if the Nexus claims are accurate, the incident could rank among the most alarming identity-data exposures in North America.