The Federal Bureau of Investigation (FBI) says it is investigating a report that tens of millions of U.S. and Canadian driving licences are being sold on dark web marketplace.

Reuters reported on Wednesday the FBI said in a statement that it was “looking into the incident” and declined to comment “due to the ⁠ongoing nature of the investigation.”

The report was by Brian Krebs, an investigative journalist, who discovered that a platform on the dark web was selling digital scans of over 150 million drivers’ licences from individuals in the U.S. and Canada, and other identity documents.

Mr Krebs revealed that the service was named Nexus and claimed to have over 153 million driving licences, as well as other identification cards, such as travel documents, employment authorisation, and medical records.  

He said he was alerted to the platform on Monday after his own driving licence was advertised on Exploit, a Russian cybercrime forum, as a free sample.

Mr Krebs noted the authenticity of the data belonging to dozens of people being sold on the website, including several high-ranking government officials such as U.S. Defense Secretary Pete Hegseth.

He said that the site was being fed by a current breach as the platform updated stolen data in real time.

Mr Krebs also found that the driving licence belonging to cybersecurity threat researcher Zach Edwards was among the records on the platform, and he helped to investigate where his licence had been scanned 

Mr Edwards told him he had handed over his licence at three locations, which included a security checkpoint, his hotel, and Planet 13, a Las Vegas marijuana dispensary, where he believed it was scanned.

He explained that only one of those three scanned his ID with some kind of device.

Mr Krebs discovered that the dispensary used IDScan.net, a New Orleans-based identity verification service that works with other big companies such as Target, FedEx, Motorola Solutions, Henry, and Caesars Entertainment.

However, the company said it was investigating the incident, as the source of the stolen data had not been established.