A former cybersecurity journalist, Bryan Krebs, has uncovered an illegal online service offering access to 153 million U.S. and Canadian driver's licenses. The data appears to have been taken from the systems of a company that provides identity verification services. The Federal Bureau of Investigation (FBI) has begun an investigation into the matter. Krebs learned about the service on August 31 when a source sent him a screenshot of their own driver’s license information. He then accessed a tool called Nexus, which was available on a Russian online forum used for trading stolen data. The tool was reportedly removed from the forum after its existence was revealed. According to Krebs, the database included not only 153 million driver's licenses but also 10 million identity cards, nearly 2 million travel documents, and almost 600,000 medical cards. The database's counters kept increasing, suggesting that it was being continuously updated. Krebs noted that 400,000 new driver’s licenses were added to the database in just one day. The creators of Nexus claimed to have been adding data to their private database for over a year. Krebs tested the database by checking with twelve friends and found that nine of them were listed. After checking the data further, Krebs linked the presence of certain documents to recent travel activities, including car rentals from Hertz. Another cybersecurity expert, Zach Edwards, observed that the timestamps on the data matched a recent car rental during a holiday period. Edwards had only provided his driver’s license when registering at a hotel in Las Vegas and at a cannabis dispensary during a trip to a technology conference called Defcon. The services associated with the data appear to be linked to ID Scan, an American company that specializes in identity verification and claims to be a leader in preventing fraud involving fake documents. ID Scan's clients include Hertz, a chain of dispensaries, FedEx, several car manufacturers, and Shell. However, the company has not yet commented on the possibility of a data breach. The FBI has taken an interest in the case, and Krebs was invited to join a conference call with several cybercrime specialists. Krebs noted that the deputy director of the FBI had their driver's license listed on Nexus, although the director’s license was not found. It is unclear how ID Scan will respond or when access to the data will be blocked. A comment on Krebs’s post suggested that the company began informing its enterprise clients about the breach on March 2, but the truth of this claim is still uncertain.