If you’ve shared your driver’s license, passport, or any form of identification for verification in various settings such as bars, dispensaries, or car rental services, it’s quite possible that your information has been compromised due to a significant data breach.
This alarming situation was revealed by independent security journalist Brian Krebs, who reported that a company, responsible for verifying government-issued IDs in person, may have been hacked, resulting in the theft of extensive records of identification documents.
Krebs uncovered that a dark web site known as Nexus has emerged, claiming to host a searchable database of over 150 million driver’s licenses and passports from individuals in the United States and Canada. An advertisement on a well-known Russian cybercrime forum asserted that Nexus is adding about 500,000 new documents each day, suggesting that the hackers have near real-time access to the identity verification firm’s systems.
The advertisement claims that “customer photos are displayed if available.” When Krebs conducted a search, he discovered that his own driver’s license was in the database, affirming the data’s validity. Notably, Secretary of Defense Pete Hegseth’s photo was also found on the site.
A representative from the Department of Defense indicated to TechCrunch that they are aware of the situation and are assessing its implications.
Collaborating with security researcher Zach Edwards, whose ID was also compromised, Krebs tracked the breach back to the identity verification service IDScan. This Louisiana-based firm is trusted by numerous tech and consumer brands to verify millions of IDs monthly.
While IDScan’s CEO Jimmy Roussel did not respond to inquiries from TechCrunch, the company’s COO Jillian Kossman stated they are investigating the incident. Krebs also mentioned that the FBI’s New Orleans field office is looking into the breach, although a spokesperson for the FBI has not commented on the matter.
Nexus was taken offline shortly after Krebs published his findings.
This breach occurs at a time when governments are increasingly implementing age verification laws, which often require individuals to submit identification documents to prove their age for access to specific websites or applications. Security experts and privacy advocates have consistently warned that the long-term storage of such sensitive information by companies increases the risk of data theft.
All indications suggest this may represent the largest known breach of identity documents in recent history.
