Major ID Verification Company Suspected in Massive Driver’s License and Passport Data Breach

A suspected cyberattack on a major identity verification service may have exposed millions of driver’s licenses and passports belonging to people in the United States and Canada, raising new concerns about the security of digital identity checks.

Security journalist Brian Krebs reported that a dark web identity theft service called Nexus claimed to provide access to more than 150 million government-issued identity documents. The service allegedly sourced the records from a major identity verification provider, with claims that hundreds of thousands of new documents were being added daily.

Identity Verification Service Investigated After Data Leak Claims

Krebs reported that the database included searchable driver’s licenses and passports, with some records containing customer photos. He said his own driver’s license appeared in the database, confirming that at least some of the exposed information was authentic. A photo linked to U.S. Defence Secretary Pete Hegseth was also reportedly listed among the records.

The U.S. Department of Defence said it was aware of the reports and was evaluating the situation. Security researcher Zach Edwards also reported that his identity document was included in the leaked data.

IDScan Named as Possible Source

Working with Edwards, Krebs identified IDScan as the likely source of the stolen records. The company provides identity verification services that businesses use to verify government-issued IDs for customers.

IDScan’s chief operating officer Jillian Kossman said the company was investigating the incident. The FBI’s New Orleans field office was also reported to be examining the breach. The Nexus site went offline shortly after Krebs published his report.

Growing Privacy Concerns Around Identity Verification

The incident comes as more companies and governments rely on identity verification systems for age checks and access controls. Privacy advocates and security experts have repeatedly warned that storing large collections of identity documents creates a valuable target for cybercriminals.

The breach investigation is ongoing, but if confirmed, it would represent one of the largest known compromises of government-issued identity documents. The initial findings were reported by KrebsOnSecurity, with additional information from security researcher Zach Edwards.