US Pentagon triggers red flag warning for 150M+ American drivers after massive ID breach — is your identity exposed? Do this now

That question is now hanging over drivers across the country after more than 153 million driver’s license records appeared for sale on the dark web.

The massive trove reportedly included scans of the front and back of licenses, customer photos and other information that could help a fraudster convincingly pose as someone else.

Even America’s defense secretary was apparently caught in the dragnet. Cybersecurity journalist Brian Krebs found a driver’s license belonging to Pete Hegseth in the database, prompting the Pentagon to tell TechCrunch it is “aware of these reports and is evaluating them.” The license of an FBI assistant director was reportedly exposed as well.

The FBI has since confirmed that it is “looking into the incident.” Meanwhile, IDScan.net — the identity-verification company identified as the apparent source — has acknowledged that an unauthorized party may have accessed or copied customer information stored in its cloud.

If you have ever had your ID scanned while renting a car, entering a venue or proving your age, you may have no easy way to know where that image was stored — or whether it was swept up in this breach.

And unlike a compromised password, you cannot simply change the face, birth date or other identifying details printed on your license. That makes it important to act before an unfamiliar account, loan or transaction appears in your name.

How a tool built to stop fraud may have fueled it

The alarming discovery began when Krebs was tipped off to a new dark-web service called Nexus, which claimed to let paying customers search through a vast collection of stolen identity documents.

According to KrebsOnSecurity, Nexus advertised more than 153 million driver’s license records from the U.S. and Canada. Krebs’ search filtered for Canadian driver’s licences returned roughly 1.1 million results, suggesting the overwhelming majority of the 153 million-plus records were American.

Some records reportedly contained multiple images of the same license, including scans captured under infrared and ultraviolet light — features ordinarily used to determine whether an ID is authentic.

In other words, the very information gathered to stop someone from using a fake ID may now make it easier to impersonate the person holding a real one.

The people behind Nexus claimed they had been pulling data for more than a year. Krebs found his own license in the trove. He also found licenses belonging to nine friends and family members, all of whom confirmed they had traveled on or near the dates shown in the attached timestamps.

IDScan later acknowledged that an unauthorized party may have accessed or copied customer data from its cloud, including names and government-issued ID numbers. The company has not confirmed that 153 million distinct people were affected, although TechCrunch noted that it holds more than 150 million driver’s license records.

The company is notifying potentially affected people and offering free credit monitoring and identity-protection services. Anyone wishing to enroll can call 1-833-516-2980.

What criminals could do with your license

A license image can be combined with information from previous breaches, social media or people-search websites to build a more convincing profile of you. Criminals could use it to try to open new credit accounts, defeat identity-verification checks or pose as you when contacting a financial institution.

That is why waiting for IDScan to confirm whether your specific record was involved may not be the safest approach. The company itself is urging consumers to review their credit reports and account statements for suspicious activity.

You can also place a free credit freeze with Equifax, Experian and TransUnion, making it harder for someone to open a new account in your name. A fraud alert is another option: Contact one of the three major credit bureaus and that bureau is generally required to notify the other two.

Keep an eye out for credit inquiries, new accounts, password-reset messages or authentication requests you do not recognize. If you discover identity theft, report it at IdentityTheft.gov and contact the affected financial institution immediately.

Still, monitoring every account, public record and corner of the dark web on your own can become a job in itself. That is where an identity-protection service can help.

Put your identity under 24/7 watch

If you want some added peace of mind, platforms like Aura offer a way to safeguard your personal information.

The AI-powered service removes your personal data from Google search results, people-search sites and brokers that sell your data to advertisers. Aura can even scan the dark web and data breach sources for your credentials and alert you to any leaks of your data.

Aura also monitors spending patterns so you always know when a suspicious transaction pops up and if identity theft does happen, their $1 million insurance protection covers eligible losses and fees.

You could save up to 68% if you sign up today — and Aura even offers a risk-free, 60-day money-back guarantee.