If you’ve ever handed over your passport, driver’s license, or another official ID to prove your identity at a physical location—such as a dispensary, a bar, or a car rental counter—there is a strong possibility your sensitive information has been compromised in an alleged massive security breach.
That alarming revelation comes from a stunning investigative report by prominent independent cybersecurity journalist Brian Krebs, who uncovered that a firm responsible for verifying government-issued credentials offline was seemingly breached, allowing malicious actors to loot its massive archives of personal identification cards.
According to Krebs, a freshly minted dark web identity theft portal dubbed Nexus debuted this week, boasting the capability to let users query a staggering stash of over 150 million passports and driver’s licenses belonging to residents across the U.S. and Canada. A promotional post surfaced on a prominent Russian cybercrime forum claiming that Nexus was continuously pulling in roughly 500,000 fresh records every day straight from a “major identity verification provider,” which strongly suggests the cybercriminals secured near live-feed access to the vendor’s internal infrastructure.
The marketing pitch boasted that “user portraits are shown whenever accessible.” Upon investigating, Krebs discovered his personal driver’s license was indexed within the searchable database, verifying the information’s legitimacy. Additionally, Defense Secretary Pete Hegseth’s credentials were found featured on the illicit lookup platform.
A representative for the Department of Defense informed TechCrunch that officials are “monitoring the situation and actively assessing the claims.”
Teaming up with cybersecurity specialist Zach Edwards—whose personal ID credentials were likewise swept up in the incident—Krebs pinpointed Louisiana-based verification vendor IDScan as the probable vector. Numerous major consumer brands and technology giants depend on the firm to authenticate tens of millions of global identity documents monthly.
While IDScan CEO Jimmy Roussel did not reply to TechCrunch’s outreach for comment, company COO Jillian Kossman informed Krebs that an internal investigation was underway. Furthermore, Krebs noted that the FBI’s New Orleans field office has launched an inquiry into the incident. An agency spokesperson declined to comment when contacted by TechCrunch regarding the breach.
Shortly after Krebs published his findings, the Nexus service abruptly went dark.
This massive security failure arrives precisely as regulatory bodies aggressively push forward new age-verification mandates, which typically force adults to submit government IDs online to prove they meet age requirements for various platforms and services. Cybersecurity specialists and digital privacy advocates have repeatedly cautioned that organizations hoarding massive repositories of personal identity documents create high-value honeypots that are prime targets for malicious hackers.
