🤦♂️ Driver’s License Dump Lays Bare Hazards of Data Hoarding
This article originally appeared in Galaxy Research's weekly newsletter. Subscribe to get timely insights delivered to your inbox every Friday morning.
More than 153 million American and Canadian driver’s licenses were exposed in an apparent data breach of a widely used identity verification service, cybersecurity researcher Brian Krebs reported Tuesday.
Krebs learned about the incident because his license was compromised. A dark web vendor known as Nexus was offering it as a free sample of the 170 million stolen records it was selling on a Russian forum. Aside from scans of licenses (including U.S. Secretary of War Pete Hegseth’s), the trove included identification cards, medical cards, and travel documents.
The FBI (whose assistant director’s license was also exposed) has opened an investigation, Krebs and Reuters reported. Shortly after Krebs posted his article, Nexus' website disappeared.
Another victim was Krebs' mother. Both had shared their licenses with the Hertz car rental service, as did three other people whose data was compromised. Yet another scanned his license at a marijuana dispensary that had something in common with Hertz: IDScan.net, the verification service, listed both as clients.
IDScan told Krebs it was investigating the matter. As of writing, the company had not issued a detailed statement.
A third IDScan client, bank technology vendor Jack Henry & Associates, disclosed a cybersecurity incident Monday. “Based on our investigation to date, personally identifiable information (PII) data for fewer than 10 clients was impacted,” Jack Henry said. (Its clients are banks, not their customers.)
That incident, which involved voice phising and an extortion attempt, may be unrelated to the one Krebs reported. A Jack Henry spokesman told Galaxy Research: “While we use one IDScan.net product in our OpenAnywhere digital deposit account opening platform as an optional feature, we have been notified by IDScan.net that this specific product is not impacted. We are actively monitoring the situation and keeping our clients informed.”
Other IDScan clients include the U.S. Coast Guard, FedEx, Motorola Solutions, and Caesars Entertainment, according to a screengrab in Krebs' report.
The IDScan breach would rank among the top 20 in U.S. history by number of records leaked, according to data from cyber risk management firm UpGuard. It’s on par with the 2017 Equifax incident, which exposed sensitive data of 147 million U.S. and 15 million U.K. consumers.
Our take
This debacle underscores a message that cryptocurrency and cybersecurity community members have been shouting from the rooftops for years: data is a liability.
In a comment letter to the U.S. Treasury last year, we explained:
U.S. citizens are required to share copious amounts of personally identifiable information (PII) with strangers on a daily basis, simply to get by. Even to purchase cold medicine at the drugstore, Americans have to scan their driver’s licenses. Each time a consumer entrusts PII to a business, they widen the attack surface for would-be identity thieves. ... Promiscuous data collection turns businesses into “honeypots,” irresistible targets for hackers.
Many businesses need to learn something about their customers. A car rental service needs to know you are fit to drive. A dispensary or casino needs to know you’re of legal age. Financial institutions, famously, are required by law to “know your customer” (KYC).
Personally identifiable information should be handled with care, if at all.
PII should be handled with care, if at all. Businesses should collect only the data they absolutely need to operate and dispose of it as soon as they legally can. While that’s standard practice, many organizations cut corners.
Whenever data is retained, access should be locked down tight. Last year, Coinbase disclosed that nearly 70,000 of its customers’ sensitive details were leaked. Criminals obtained this information by bribing contractors and employees outside the U.S. with access to Coinbase’s systems, the company said.
Long term, we remain optimistic about zero-knowledge proofs’ potential to reduce data hoarding. “ZKP makes it possible for people to prove that something about them is true without exchanging any other data,” explained Alan Stapelberg, group product manager for Google Wallet, in a blog last year. “For example, a person visiting a website can verifiably prove he or she is over 18, without sharing anything else at all” – a feature Google added to its digital wallet.
Historically, ZKPs were slow and expensive to run, but they’re constantly improving. For example, the average cost of proving on the Ethereum blockchain steadily declined over the last 90 days, and latency generally held below a 10-second target:
Still, adoption is slow. Several apps (Zkpassport, Zpass, Rarimo) can scan a passport and spit out a proof attesting to an attribute (“at least 21 years old”; “not a North Korean national”) without doxxing the user. They face a chicken-and-egg problem: consumers have little incentive to download apps few businesses accept, and businesses have little incentive to accept forms of identification few consumers carry.
The hacker asked only $100 for War Secretary Pete Hegseth’s drivers license.
It's easy to despair. The Nexus hacker asked only $100 for Hegseth’s ID, suggesting stolen PII is so abundant it sells dirt cheap. But the worst thing to do would be to downplay this breach because “it's already out there.” Attackers can cause orders of magnitude more damage than the data costs.
We agree with Peter van Valkenburgh, executive director of crypto advocacy group Coin Center, who wrote in response to the driver’s license breach: “You should be mad. We are long, long, long overdue to reduce the amount of KYC we do as a society.” Don’t be complacent; demand better alternatives and support the developers building them. – Marc Hochstein
Legal Disclosure:
This document, and the information contained herein, has been provided to you by Galaxy Digital Inc. and its affiliates (“Galaxy Digital”) solely for informational purposes. This document may not be reproduced or redistributed in whole or in part, in any format, without the express written approval of Galaxy Digital. Neither the information, nor any opinion contained in this document, constitutes an offer to buy or sell, or a solicitation of an offer to buy or sell, any advisory services, securities, futures, options or other financial instruments or to participate in any advisory services or trading strategy. Nothing contained in this document constitutes investment, legal or tax advice or is an endorsement of any of the stablecoins mentioned herein. You should make your own investigations and evaluations of the information herein. Any decisions based on information contained in this document are the sole responsibility of the reader. Readers should consult with their own advisors and rely on their independent judgement when making financial or investment decisions.
Participants, along with Galaxy Digital, may hold financial interests in certain assets referenced in this content. Galaxy Digital regularly engages in buying and selling financial instruments, including through hedging transactions, for its own proprietary accounts and on behalf of its counterparties. Galaxy Digital also provides services to vehicles that invest in various asset classes. If the value of such assets increases, those vehicles may benefit, and Galaxy Digital’s service fees may increase accordingly. The information and analysis in this communication are based on technical, fundamental, and market considerations and do not represent a formal valuation. For more information, please refer to Galaxy’s public filings and statements. Certain asset classes discussed, including digital assets, may be volatile and involve risk, and actual market outcomes may differ materially from perspectives expressed here.
For additional risks related to digital assets, please refer to the risk factors contained in filings Galaxy Digital Inc. makes with the Securities and Exchange Commission (the “SEC”) from time to time, including in its Quarterly Report on Form 10-Q for the quarter ended September 30, 2025, filed with the SEC on November 10, 2025, available at www.sec.gov.
Certain statements in this document reflect Galaxy Digital’s views, estimates, opinions or predictions (which may be based on proprietary models and assumptions, including, in particular, Galaxy Digital’s views on the current and future market for certain digital assets), and there is no guarantee that these views, estimates, opinions or predictions are currently accurate or that they will be ultimately realized. To the extent these assumptions or models are not correct or circumstances change, the actual performance may vary substantially from, and be less than, the estimates included herein. None of Galaxy Digital nor any of its affiliates, shareholders, partners, members, directors, officers, management, employees or representatives makes any representation or warranty, express or implied, as to the accuracy or completeness of any of the information or any other information (whether communicated in written or oral form) transmitted or made available to you. Each of the aforementioned parties expressly disclaims any and all liability relating to or resulting from the use of this information. Certain information contained herein (including financial information) has been obtained from published and non-published sources. Such information has not been independently verified by Galaxy Digital and, Galaxy Digital, does not assume responsibility for the accuracy of such information. Affiliates of Galaxy Digital may have owned, hedged and sold or may own, hedge and sell investments in some of the digital assets, protocols, equities, or other financial instruments discussed in this document. Affiliates of Galaxy Digital may also lend to some of the protocols discussed in this document, the underlying collateral of which could be the native token subject to liquidation in the event of a margin call or closeout. The economic result of closing out the protocol loan could directly conflict with other Galaxy affiliates that hold investments in, and support, such token. Except where otherwise indicated, the information in this document is based on matters as they exist as of the date of preparation and not as of any future date, and will not be updated or otherwise revised to reflect information that subsequently becomes available, or circumstances existing or changes occurring after the date hereof. This document provides links to other Websites that we think might be of interest to you. Please note that when you click on one of these links, you may be moving to a provider’s website that is not associated with Galaxy Digital. These linked sites and their providers are not controlled by us, and we are not responsible for the contents or the proper operation of any linked site. The inclusion of any link does not imply our endorsement or our adoption of the statements therein. We encourage you to read the terms of use and privacy statements of these linked sites as their policies may differ from ours. The foregoing does not constitute a “research report” as defined by FINRA Rule 2241 or a “debt research report” as defined by FINRA Rule 2242 and was not prepared by Galaxy Digital Partners LLC. Similarly, the foregoing does not constitute a “research report” as defined by CFTC Regulation 23.605(a)(9) and was not prepared by Galaxy Derivatives LLC. For all inquiries, please email [email protected].
©Copyright Galaxy Digital Inc. 2026. All rights reserved.