More than 153 million digital scans of driver’s licenses from the United States and Canada were recently put up for sale on the dark web.
A cybercrime platform named Nexus offered the stolen documents alongside medical cards, employment records, and residence cards.
The Federal Bureau of Investigation has launched an official probe into the breach through its New Orleans field office.
Cybersecurity journalist Brian Krebs disclosed the breach after verifying the authenticity of the records with the hackers.
The cybercriminals provided Krebs with a copy of his own driver’s license to prove the validity of the data.
A driver’s license scan belonging to Secretary of Defense Pete Hegseth was also found listed on the platform for $100.
Inquiries suggest the database originated from a hack of Louisiana-based identity verification service IDScan.
Many victims had recently rented vehicles from Hertz, a car rental service that utilizes IDScan for identity checks.
The verification company also counts major corporations such as Target, FedEx, Motorola, and Jack Henry among its clients.
Describing the ease with which private information is exposed, social media user Michael Rusch warned that personal identification is easily commodified.
“You hand over your id to rent a car or check into a hotel for the weekend and a copy can end up for sale to anyone,” according to the Engadget.
An online commenter using the pseudonym AsISeeIt expressed outrage over the leak and advocated for financial liability.
“It’s time for all businesses to be bonded for this kind of breech.”
Although the Russian cybercrime forum Exploit initially hosted advertisements for the illicit service, Nexus has since closed down its operations.
The digital scans are no longer active on the platform, but the sensitive files remain in circulation on the internet.