Hackers Allegedly Accessed Over 150 Million U.S. and Canadian ID Photos
A dark-web site claimed to host more than 150 million driver’s license and passport images, likely stolen from ID verification firm IDScan, prompting investigations by the FBI and the Department of Defense.
A new dark-web marketplace called Nexus advertised a searchable database of over 150 million driver’s licenses and passports from the United States and Canada. The site, which appeared on a Russian cybercrime forum, said it received roughly half a million new documents each day from a "major identity verification company," suggesting near-real-time access to the source’s systems.
Security journalist Brian Krebs confirmed the authenticity of the data after finding his own driver’s license and a photo of Defense Secretary Pete Hegseth in the listings. He and researcher Zach Edwards traced the leak to IDScan, a Louisiana-based firm that provides identity-verification services for major brands worldwide.
IDScan’s chief operating officer Jillian Kossman said the company is investigating the incident, while the FBI’s New Orleans field office is also probing the breach. A Department of Defense spokesperson said officials are aware of the reports and are evaluating them.
Nexus was taken offline shortly after the story was published. The breach highlights concerns about the growing reliance on age-verification systems that require users to upload government-issued IDs, which security experts warn can create large, attractive targets for hackers.