A suspected data breach at an identity verification service may have exposed the driver’s licenses, passports, and other government-issued ID documents of tens of millions of people across the United States and Canada. If you have ever handed over an ID to verify your identity at a bar, a cannabis store, or a car rental counter, that document may now be in the hands of hackers.
The findings come from independent security journalist Brian Krebs, who reported that a company relied on to verify government-issued identity documents in the real world was likely hacked, with its vast archive of ID cards exfiltrated.
What the Hackers Claimed to Steal
An identity theft site called Nexus, which launched on the dark web this week, claimed to let users search more than 150 million driver’s licenses and passports belonging to residents of the United States and Canada. A post advertising the site on a known Russian cybercrime forum said Nexus added roughly half a million new documents daily, drawn from a “major identity verification company” — implying the attackers had near real-time access to that company’s systems.
The listing claimed that “customer photos are displayed if available.” Krebs verified the data was authentic after finding his own driver’s license among the searchable records. Secretary of Defense Pete Hegseth was also among the individuals whose photos appeared on the site. A Department of Defense spokesperson said it is “aware of these reports and is evaluating them.”
IDScan Named as the Likely Source
Working with security researcher Zach Edwards, whose ID was also stolen, Krebs identified the likely source as the identity verification service IDScan. The Louisiana-based company is used by major tech and consumer brands to verify tens of millions of IDs worldwide each month.
IDScan chief executive Jimmy Roussel did not return a request for comment, but chief operating officer Jillian Kossman said the company was investigating. The FBI’s New Orleans field office is also reportedly probing the incident. Nexus went offline shortly after the report was published.
A Warning About Age-Verification Laws
The breach lands as governments increasingly roll out age-verification laws, which largely require adults to upload identity documents to prove they are old enough to access a website or app. Security experts and privacy advocates have long cautioned that companies storing large volumes of ID documents for extended periods put that data at risk of theft.
By all accounts, this would be the largest known single breach of identity documents in some time.
Source
Image: techcrunch.com
