Major ID Verification Service IDScan Likely Hacked, 150M+ Records Exposed
Original: It sure looks like hackers breached a major ID card verification service
Why This Matters
Potentially the largest single breach of identity documents in recent history, affecting over 150 million people.
A dark web site called Nexus claimed access to over 150 million driver's licenses and passports from the U.S. and Canada, with security journalist Brian Krebs tracing the breach to Louisiana-based identity verification firm IDScan. The FBI's New Orleans field office is investigating.
Security journalist Brian Krebs reported that a dark web identity theft site called Nexus launched this week, claiming to offer searchable access to more than 150 million driver's licenses and passports belonging to U.S. and Canadian residents. A post on a Russian cybercrime forum advertising Nexus stated that roughly 500,000 new documents were being added daily, sourced from a 'major identity verification company,' suggesting near real-time system access by the attackers. Customer photos were also reportedly available. Krebs confirmed the data's authenticity by finding his own driver's license in the database. U.S. Secretary of Defense Pete Hegseth's photo was also found listed on the site. Working with security researcher Zach Edwards, Krebs identified Louisiana-based IDScan as the likely breached company, a firm that processes tens of millions of ID verifications monthly for major brands globally. IDScan's COO told Krebs the company was investigating; its CEO did not respond to TechCrunch. The FBI's New Orleans field office is probing the incident. Nexus went offline shortly after Krebs' report was published. The breach highlights long-standing warnings from security experts about the risks of storing large volumes of identity documents.