Hackers apparently breached a major ID verification company, exposing millions of identity documents
Security researcher Brian Krebs reports that hackers likely breached identity verification firm IDScan, leaking over 150 million driver's licenses and passports on a dark web site. The FBI is reportedly investigating.
Independent security journalist Brian Krebs has reported what appears to be a massive breach in the identity verification industry. According to his findings, a company used to verify people's driver's licenses and passports in real-world settings — such as bars, stores, or car rental locations — was hacked, with vast amounts of data stolen from its systems.
This week, a dark web site called Nexus appeared, claiming to offer searchable access to more than 150 million driver's licenses and passports belonging to residents of the United States and Canada. An advertisement on a Russian cybercrime forum stated that roughly half a million new documents were being added daily, sourced from a "major identity verification company," suggesting the attackers may have had near real-time access to that company's systems. The ad also claimed customer photos were displayed when available.
Krebs confirmed the authenticity of the data after finding his own driver's license in the database. Photos of U.S. Defense Secretary Pete Hegseth were also reportedly among the searchable records. A Department of Defense spokesperson told TechCrunch it was aware of the reports and evaluating them.
Working with security researcher Zach Edwards, whose ID was also found in the leak, Krebs traced the likely source to IDScan, a Louisiana-based company relied on by major tech and consumer brands to verify tens of millions of people's identities worldwide each month. IDScan's CEO, Jimmy Roussel, did not respond to a request for comment, but the company's chief operating officer, Jillian Kossman, told Krebs the company was investigating. Krebs said the FBI's New Orleans field office is also looking into the breach.
The Nexus site went offline shortly after Krebs published his report. The breach comes as governments increasingly roll out age-verification laws that require users to upload identity documents to prove their age online. Security experts have long warned that storing such large volumes of identity documents creates a significant risk of theft. If confirmed, this would reportedly be one of the largest known single breaches of identity documents in recent memory.
