Hegseth’s license allegedly among 150M IDs offered after IDScan.net breach

More than 150 million driver’s licenses have allegedly been listed for sale on the dark web after an apparent breach at IDScan.net, a company that verifies identities. One of those licenses reportedly belongs to US Secretary of War Pete Hegseth.

His ID carries a $100 price tag. The FBI is looking into the incident, KrebsOnSecurity reports.

The IDs were being peddled by Nexus, a Russian identity theft service, which claims to hold travel documents, medical cards, and various other forms of identification.

Nexus asserts that it has been “continuously exfiltrating new data for over a year into our private database.”

Over the past few days, hundreds of thousands of new entries have gone into the database. KrebsOnSecurity notes, however, that the service can no longer be reached.

Risk to data held by numerous Fortune 500 companies

Cybersecurity analyst vx-underground has circulated a list of IDScan clients whose data may have been exposed.

The roster includes Shell, AMC Theaters, DraftKings, Dutchie, FedEx, Hertz, Chevrolet (General Motors), GameStop, Jack Henry, MRI (Checkpoint ID), Polaris, Simmons Bank, LendingUSA, Circa Resort & Casino, Planet 13, Rouses Market, US Coast Guard Academy, Caesars Entertainment, and Motorola.

Nexus also reportedly describes the breach as involving “a major identity verification company” with multiple Fortune 500 companies as clients.

ID leak after cannabis dispensary visit

Privacy researcher Zach Edwards confirmed that his ID was in the leak following a trip to Planet13 in Las Vegas, described as the “largest cannabis dispensary in the world.”

Edwards said the indications all suggest “IDscan having a hellacious ongoing real-time breach of their data.”

Weeks of hacks and leaks

Thousands of X users also had a security scare this week, with their accounts hit by a wave of suspicious password-reset emails.

Cloud storage provider Dropbox was also hit by a hack last month, giving attackers access to data from 5,000 compromised accounts.

Unreleased GTA VI footage likewise leaked, and pseudonymous X user Cyberleek used the stolen clips to pump their cryptocurrency.