Licences scanned at Hertz rental counters were in the Nexus database
Assessment
Krebs's method was to match the GMT timestamps on Nexus image files against the movements of people who agreed to be looked up. His own record and his mother's are stamped seconds apart on the day both handed licences to the same Hertz representative; two federal employees and a Cybera researcher matched Hertz rentals; one person had rented from Hertz for months around their timestamp. Hertz is listed as an IDScan.net client. Hertz has not commented, and IDScan.net has not named affected customers. The inference is strong and multiply corroborated; it remains an inference.
Where this claim appeared
KrebsOnSecurity · 2026-09-01
https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/What “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
IDScan.net Breach: 153 Million Driver's Licence Scans and the Default Setting That Kept ThemThink this assessment is wrong? Report an error.