Including That Of US SecDef Pete Hegseth
The service was advertised on the Russian cybercrime forum Exploit, where whoever was promoting it posted the driver’s license of Krebs as a free sample, which caught the journalist’s attention. He was also able to see a preview of U.S. Secretary of Defense Pete Hegseth’s information on the database — a concerning breach of security for someone with such a sensitive position in the government. After further investigation, they concluded that the service seemed to have possessed legitimate data, especially after searching for the data of several of his friends and family members with their consent. One thing that all the people he found in the database had in common was that they all used Hertz to rent a vehicle.
Based on the evidence gathered by Krebs, it seems that the leak is centered around the company. He has already contacted the company about the issue, and they said they were investigating the matter. “At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation,” Jillian Kossman, a marketing and operations leader at idscan.net, told the journalist. The FBI has also started looking into the leak, with its New Orleans field office opening an official investigation into the breach.
The massive amount of data that was briefly available on the dark web is certainly concerning. A similar data breach hit Discord after its third-party service provider was hit and resulted in the exposure of 70,000 government IDs. Incidents like these have got privacy experts concerned with the push for online age verification requirements, which is why the EFF is asking the California governor to veto the law requiring this.
Aside from privacy-invasive checks and stepping on First Amendment rights, the leakage of sensitive data like this could increase incidents of stolen identity and more. Driver’s licenses are often widely accepted for opening credit lines and bank accounts, with both photographic, UV, and IR scans available on many of the leaked licenses. Aside from that, it could also potentially compromise the privacy and security of vulnerable people, like those fleeing domestic violence and those who are under the witness protection program.
(Score: 4, Informative) by JoeMerchant on Friday September 04, @03:34AM
https://arstechnica.com/security/2026/09/my-drivers-license-is-one-of-153-million-for-sale-on-a-new-dark-website/ [arstechnica.com]
🌻🌻🌻🌻✌️ [google.com]
(Score: 3, Interesting) by jb on Friday September 04, @07:53AM (2 children)
Anyone know how far back the compromised records go?
I'm not an American, but TFA did say the compromised records included international licenses too ... and I recall renting a couple of vehicles from Hertz on the only occasion I've ever visited the US, about 20 years ago. Can't check on the crook's site (like Krebs did to discover his own record on the list) either, as they've taken it down now.
(Score: 1, Informative) by Anonymous Coward on Friday September 04, @12:15PM
> about 20 years ago.
I think you are safe, I rented from Hertz back then (inside USA) and don't recall them scanning my driver's license, just using it to verify my identity. The scanning started more recently.
(Score: 4, Informative) by JoeMerchant on Friday September 04, @12:24PM
I believe this started with the recent "identify everybody for all the things all the time" foolishness. If you could still browse PornHub from Alabama at the time, I think your DL was safe from scanning.
🌻🌻🌻🌻✌️ [google.com]
(Score: 5, Insightful) by Thexalon on Friday September 04, @01:30PM (1 child)
Period. End of discussion. If a corporation is storing valuable personal data, the odds that it will be stolen and exposed is approximately 100% in the long run.
And when it is, it will be treated primarily as first a PR problem (where the goal is to stall and hem-haw until the story goes away), then a legal problem (where the goal is to make it somebody else's fault), and in no way a technical problem.
The reason for this phenomenon is that the corporation has no real incentive to keep the private data private. Keeping the private data private costs money. So it is guaranteed that at some point a more reckless boss will come along, say "Why are we wasting all this money on computer security?", cut the budget, and eventually it will all break.
The solution would be for businesses to quit storing so much data that they don't actually need to conduct business, but as long as storage is about $25 per terabyte per year that is unlikely to happen.
"Think of how stupid the average person is. Then realize half of 'em are stupider than that." - George Carlin
(Score: 2) by JoeMerchant on Friday September 04, @06:03PM
Oh, but they have policies and procedures and the procedures guarantee you are due an apology if you can ever prove that their negligence has resulted in significant damages to yourself or your bank balance...
There's an old tale out of NASA about a procedure that required 50 certified qualified vetted experienced engineers to sign off that a simple, easily verifiable, very expensive if forgotten, step be done. It took less than 20 space shuttle cycles before all 50 of them signed off that it was complete and it wasn't and the expensive thing happened. This is one (of many) inherent problems with big corporate environments.
It only takes one screw up to let out a secret, in a big corporate environment there are literally thousands of potential failure points that can lead to exposure of your protected information.
Throw on the tendency to "outsource" and the reduced standards that contractors are (not) held to and you only accelerate and enlarge the failures.
🌻🌻🌻🌻✌️ [google.com]
(Score: 3, Informative) by VLM on Friday September 04, @07:13PM (2 children)
Ah I see now, its a false flag operation. Public not supporting using drivers licenses to access every website you click? Well we'll teach them a lesson... after we upload the database they'll PLEAD to merely use fingerprints and retina scanners. Because I'm sure that just because its possible to upload a file of 153 million alphanumerics, I'm sure its totally impossible to upload a directory of 153 million retina.jpg or fingerprint.jpg files. To claim otherwise would be double plus ungood, big brother loves us and has spoken.
(Score: 2) by jb on Saturday September 05, @06:51AM
The logic doesn't stack up. Think about it. Why should a car rental company need to identify its customers anyway? I can only think of three potential reasons, none of which appear to be valid:
1. For the customer's convenience, to prove that the person picking up the car is the same person who booked it (otherwise few people would bother booking in advance and just take whatever was available on the lot on arrival; with many of those who had booked most likely missing out altogether). This does not require ID, just proof of booking: a printout of the booking slip (or just the booking reference number if booked over the phone) would suffice.
2. So you don't just steal their car. This reason has almost no merit at all, since the sort of crooks who are likely to try stealing a rental car would no doubt show up with fake ID anyway.
3. So they can bill the driver the cost of any fines that show up from automated speed/red light/toll gate/etc. cameras after the customer has returned the car which are dated during the time he rented it. This reason holds no water at all today (although it did last century): for the last 25+ years no major rental car company has been willing to accept payment by cash or cheque, they always insist of credit cards ... and their contracts state that once they have your credit card details they can continue charging it for any other expenses that "may arise". So again, no need for ID at all (just a need to validate that the credit card used for payment is real and valid, which they already do before they hand over the keys anyway).
(Score: 2) by cereal_burpist on Monday September 07, @02:19AM