Dark web site claims access to 150 million stolen US and Canadian ID documents
A suspected breach of identity verification service IDScan has exposed driver's licenses and passports to a searchable database on the dark web.
What happened
A dark web site called Nexus launched this week claiming to provide searchable access to more than 150 million driver's licenses and passports from the United States and Canada, with posts on Russian cybercrime forums indicating the source was a major identity verification company. Security journalist Brian Krebs identified the likely source as IDScan, a Louisiana-based company that verifies tens of millions of IDs monthly for major tech and consumer brands. Krebs confirmed the data's authenticity by locating his own driver's license in the searchable records; Secretary of Defense Pete Hegseth's photo was also listed. IDScan's chief operating officer told Krebs the company was investigating, and the FBI's New Orleans field office is probing the breach. Nexus went offline shortly after Krebs' report.
Context
This breach exposes the vulnerability of centralized identity document storage at a time when governments are increasingly implementing age verification laws that require citizens to upload identity documents online. Security experts have long warned that companies storing vast quantities of identity documents create attractive targets for large-scale theft. The incident affects anyone who has submitted identity verification through IDScan's systems—including users of bars, cannabis retailers, car rental services, and online platforms—and represents what sources describe as the largest known single breach of identity documents in recent memory.
What's disputed
IDScan's CEO did not respond to requests for comment; the FBI did not respond to inquiries about the investigation. The initial attribution to IDScan is based on investigative reporting and circumstantial evidence rather than a confirmed statement from the company or law enforcement.