FBI Investigates Dark Web Service Allegedly Selling MILLIONS of Stolen IDs — Including Pete Hegseth’s

The FBI is investigating a dark web service called "Nexus," that is allegedly selling digital scans of more than 153 million U.S. and Canadian driver’s licenses.

The massive database was apparently sourced from a breach involving IDScan(dot)net, which says it's working with… pic.twitter.com/aF11PxxzmC

— Mario Nawfal (@MarioNawfal) September 2, 2026

Click to expand...

The FBI is investigating a dark web service called “Nexus,” that is allegedly selling digital scans of more than 153 million U.S. and Canadian driver’s licenses.

The massive database was apparently sourced from a breach involving IDScan(dot)net, which says it’s working with law enforcement and forensic investigators to determine the scope of the incident.

Shortly after the story broke, Nexus went offline, with the site replaced by a message saying the service was no longer available.

Moral of the story: do NOTHING on the internet to help anyone collect even more of your personal data…

Click to expand...

Dawg, they got Pete Hegseth in the data breach. It's available for sale for $100 https://t.co/Qz651aAr3e pic.twitter.com/J8HqyLvWgp

— vx-underground (@vxunderground) September 2, 2026

Click to expand...

On Monday, Aug. 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit, offering access to digital scans of identity documents on more than 170 million people in North America. The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit.

The service, dubbed Nexus, claims to have more than 153 million drivers licenses for people in the United States and Canada, as well as more than 10 million identification cards; more than three million travel documents and/or international IDs; and at least 579,000 medical cards.

A quick look around Nexus finds they are likely not exaggerating about that 153 million number: Running a blank search in Nexus (with no search parameters entered) returns approximately 11.5 million pages of results, with roughly 15 results displayed per page. It includes documents from people in both Canada and the United States, but the bulk of these records are on Americans: searching for just Canadian drivers licenses returns approximately 1.1 million results, with the largest concentration from Ontario (473,673 records).

Curiously, the identity records include not only drivers licenses but also marijuana dispensary cards. Some of the records list their “source” as “CDL,” presumably short for “commercial drivers license.” Other records carry the source notation of “CAC,” which may refer to Common Access Cards, government issued identity cards that grant physical access to government buildings and secure rooms.

The people behind Nexus claim the license images are coming from an active breach at “a major identity verification company” whose customers include multiple Fortune 500 companies.

“We have been continuously exfiltrating new data for over a year into our private database,” the service enthused in its introductory post on Exploit. “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.”

Indeed, over the past 24 hours, the number of drivers license records listed as available in Nexus has increased by nearly 400,000, suggesting that freshly stolen license data is being harvested and uploaded to this service on a semi-regular basis.

The record that features my drivers license includes six image files — three pairs of photos of the license’s front and back — a basic image scan — as well as infrared and ultraviolet versions of the same images. A date and timestamp is appended to each image file, and the timestamp on my license scan corresponds to a date in June 2025 when I took a flight to the midwest United States to attend a family funeral.

Intent on discovering the source of this data, KrebsOnSecurity asked more than a dozen friends and family members for permission to search for their licenses in this service. Each person whose license could be found (nine of them) confirmed having traveled on or very close to the dates in the timestamps attached to their images. It is unclear what timezone these timestamps are in, but from reviewing car rental records shared by several people who helped with this research, it appears the timezone is set to Greenwich Mean Time (GMT).

Click to expand...

In a brief statement on Wednesday, the bureau said it was “looking into the incident” but could not comment “due to the ⁠ongoing nature of the investigation.”
The breach, if confirmed, could be one of the largest-ever exposures of government-issued identity documents in North America, creating risks of identity theft and fraud for tens of millions of people.
Krebs said he was alerted to the site after it was advertised on a Russian cybercrime forum, with his own driver’s license being offered as a free sample. Krebs said the service, dubbed Nexus, claimed to have tens of millions of licenses for people in the U.S. and Canada, as well as millions of other identification cards and travel documents and hundreds of ‌thousands ⁠of medical records. Krebs said that the site appeared to be updating its database of stolen data in real time, indicating that it was being fed by a live breach.
Zach Edwards, a threat researcher at the cybersecurity company Infoblox, said the incident was unprecedented in terms of its sweep.
“There’s never been a breach ⁠of driver’s licenses at this scale,” said Edwards, who added that his own license was available for sale on the site. Edwards said that the ongoing nature of the breach “means that this attack created legitimate national ⁠security risks for high-profile individuals.”

Click to expand...