tl;dr: A dark web service called Nexus was selling 153 million U.S. and Canadian driver's licenses and 3 million travel documents, reportedly exfiltrated over a year from identity verification firm IDScan (~63% of all U.S. licenses). Beyond enabling identity theft, the breach poses national security risks, as adversaries like China have historically combined such datasets to unmask intelligence operations—as Bellingcat has similarly done with leaked Russian data. The author argues identity verification firms need stricter regulation, but expects only class-action lawsuits and possible FTC action to drive improvements.