Suspected breach at IDScan exposes 150 million driver's licenses and passports
A dark web site called Nexus claimed to hold over 150 million driver's licenses and passports from a major ID verification service, which security researcher Brian Krebs identified as IDScan. Krebs confirmed his own license was among the records, and the site went offline after his report. IDScan says it is investigating, and the FBI's New Orleans field office is also looking into the breach.
The Nexus site advertised on a Russian cybercrime forum, claiming to add roughly 500,000 new documents each day from a major identity verification firm, suggesting ongoing access to the company's systems. Beyond Krebs and researcher Zach Edwards, Defense Secretary Pete Hegseth's photo appeared in the database, prompting the Department of Defense to acknowledge it is evaluating the reports. The Louisiana-based IDScan verifies tens of millions of IDs monthly for major tech and consumer brands. The site went dark following Krebs' publication, while IDScan's COO confirmed an investigation is underway alongside the FBI's New Orleans field office.
This incident arrives amid expanding age-verification laws that increasingly require adults to upload identity documents to access websites and apps. Security experts have consistently warned that long-term storage of such sensitive data creates attractive targets for hackers, and this breach may represent the largest known single theft of identity documents in recent memory.
This breach could affect millions of individuals whose personal identity documents may now circulate on criminal markets, potentially enabling fraud, identity theft, and financial crimes. Consumers who routinely present IDs at bars, rental agencies, or online verification services may face heightened risks of impersonation and account takeover. The incident may also undermine public confidence in digital identity verification systems, particularly as governments push for more age-verification mandates. Companies holding such data could face regulatory scrutiny and legal liability, while victims may struggle with long-term consequences of compromised identity documents that cannot simply be reissued.