Federal agents are investigating a suspected digital compromise after a dark web forum recently began offering millions of North American identification records for sale.
Among the documents discovered on the illicit marketplace was an official driver's licence belonging to the US Secretary of Defense Pete Hegseth. Cybersecurity researchers and federal authorities are now scrambling to trace how the sensitive data was harvested and leaked online.
Cybersecurity researchers revealed this week that a newly uncovered underground marketplace is offering millions of sensitive identification records for online purchase.
Pete Hegseth's Driving Licence Appears in the Leak
On Tuesday, security investigator Brian Krebs disclosed that the illicit operation was advertised as offering access to identity documents belonging to more than 170 million people in North America, including an official credential belonging to Pete Hegseth, whose title is also referred to as the US Secretary of War.
Federal authorities are actively examining the suspected breach after the service was first spotted on a Russian cybercrime platform earlier in the week.
A representative for the Department of Defense confirmed to TechCrunch that officials are currently reviewing the situation, stating that the agency is 'aware of these reports and is evaluating them.'
The illicit platform, operating under the name Nexus, asserts that it hosts more than 153 million North American driving licences, including the credential tied to the Secretary of Defense. Security specialist Krebs noted that the compromised document carried a price tag of $100 (£74).
153 Million Driving Licences Claimed on Nexus
Furthermore, the service claimed to have an inventory containing more than 10 million identification cards, more than three million travel documents and/or international IDs, and at least 579,000 medical cards.
Investigative reports noted that an uncounted quantity of alternative credentials also populates the illicit storefront, featuring specialised items such as retail cannabis dispensary permits and commercial driving authorisations.
In addition to these documents, the security analyst stated that the cybercrime operation supplies Common Access Cards, which function as government-issued identity cards that can grant physical access to government buildings and secure rooms.
Nexus Claims It Has Exfiltrated Data for More Than a Year
Through a published statement on the Russian cybercrime platform, the individuals operating Nexus declared, 'We have been continuously exfiltrating new data for over a year into our private database.'
The operators further explained regarding their preview system, 'Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.'
Investigators Probe How Hegseth's Details Were Obtained
Investigators have not yet determined how the files were compromised or how the perpetrators acquired the credentials of a high-ranking American official. Security researcher Brian Krebs identified IDScan.net as the likely source of the data, a digital verification provider headquartered in New Orleans.
Hegseth has not yet publicly addressed the report that his driving licence appeared on the service.
The 46-year-old Minneapolis native joined President Donald Trump's Cabinet after serving in the US Army and working as a Fox News commentator. Ever since Donald Trump handpicked him for the role, the official has drawn intense public scrutiny, particularly over his direction of military engagements involving Iran and the rapid turnover of high-ranking military leaders under his command.
IDScan.net Emerges as a Suspected Source of the Leak
Krebs identified IDScan.net as the likely source of the data, a Louisiana-based identity verification provider that helps companies authenticate customer credentials in person and online. Security researcher Krebs highlighted that timestamps attached to the images matched dates when people whose licences appeared on Nexus had used their identification at car rental counters and other identity-checking facilities.
Public marketing materials for IDScan.net reveal that its VeriScan software handles fraud prevention, age checks and visitor tracking for businesses processing millions of identity verifications monthly. The company's client list features major brands such as Hertz, FedEx and Target, as well as specialised storefronts such as cannabis dispensaries and age-restricted merchants.
The verification firm has yet to issue a public statement regarding the extent or reality of the compromise.
