IDScan.net, an in-person ID proofing company, reportedly (Brian Krebs blog) is behind a large-scale leak of identity data including facial photographs (including ultra-violet scans). Its customers include Hertz, FedEx and alcohol- and cannabis dispensaries, across 20.000 locations.
As well as Canadian citizens, high profile Americans like Pete Hegseth and security researcher Brian Krebs himself are in the leak.
Brian Krebs implies that this data could even be used to create travel profiles:
A date and timestamp is appended to each image file, and the timestamp on my license scan corresponds to a date in June 2025 when I took a flight to the midwest United States to attend a family funeral. […] Each person whose license could be found (nine of them) confirmed having traveled on or very close to the dates in the timestamps attached to their images.
The FBI has taken up investigations:
During that call, the FBI shared that earlier today their New Orleans field office opened an official investigation into an apparent breach involving idscan.net. Edwards said that as more in-person and online experiences require sharing drivers licenses, vendors who collect this sensitive data need to be held to a higher standard.
The leak was sold as part of larger package - 170M ID documents - by a dark web services called Nexus. Krebs reports that “the Nexus identity theft service website vanished from the darkweb” shortly after he had published his blog post.