The digital scans of more than 153 million drivers licenses of individuals from the United States and Canada are being sold on the dark web through an easily accessible service called Nexus.

As noted cybersecurity journalist Brian Krebs noted on his blog this week, the sale has now caught the attention of the FBI, which has launched an official inquiry.

On the same day Krebs published his post, the service mysteriously vanished from the dark web, which could make tracking down the people behind the hack more difficult.

Nonetheless, the scale of the leak is staggering, and includes not just drivers licenses, but 10 million ID cards, over three million travel documents, and over half a million medical cards as well, representing over 170 million individuals total. That’s pushing half of the United States’ and Canada’s combined populations.

The ID scans appear to have been taken from a widely-used ID verification company based out of Louisiana and even include the license of US defense secretary Pete Hegseth.

The incident highlights the dangers of having little regulatory oversight over identity verification services — a thorny subject, considering regulators continue to push for age limits for content online, rules that could put people at risk of having their identity stolen by bad agents.

The ID scans first appeared on a Russian cybercrime forum. The owner of the files caught Krebs’ attention after showing the journalist a scan of his Virginia drivers license, strongly supporting the leak’s validity.

Before it was taken down, the shadowy dark web service called Nexus allowed virtually anybody to peruse identity documents of over 170 million people in the US and Canada.

“We have been continuously exfiltrating new data for over a year into our private database,” the service boasted in a post on the Russian forum. “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.”

According to the people behind Nexus, the source of the leak is a “major identity verification company” that’s in business with several Fortune 500 companies, Krebs writes.

While the feds are starting their own investigation, Krebs dug a little deeper and found a fascinating common thread: many of those, whose identity cards showed up in the database had rented cars from the company Hertz.

“I was able to find my mother’s drivers license in this service as well, and the timestamps for her images are just a few seconds apart from mine,” Krebs wrote. “That’s notable because we both handed our licenses to the Hertz rental car representative at the same time.”

Other individuals the reporter talked to recalled giving their driver’s license to a dispensary, which struck a deal in 2022 with ID verification company idscan.net — which also provides services to other big brands, including Hertz.

The New Orleans-based firm told Krebs that it’s now investigating the matter. The FBI has also confirmed that it’s also officially looking into the company.

More on identity leaks: Discord’s Verification Saga Has Devolved Into a Complete Self-Inflicted Embarrassment