It sure looks like hackers breached a major ID card verification service

If you have handed over your driver’s license, passport, or other form of identity document to verify your information in the real world, like at a bar, a weed store, or when booking a car rental, there’s a good chance it’s now been stolen in a suspected massive data breach.

That’s according to a jaw-dropping report by independent security journalist Brian Krebs, who says a company used to verify government-issued identity documents in the real world was likely hacked and its vast stores of people’s ID cards were exfiltrated.

Krebs reports that an identity theft site called Nexus, which launched on the dark web this week, claimed to allow users to search through more than 150 million driver’s licenses and passports belonging to people who live in the United States and Canada. A post advertising the site on a known Russian cybercrime forum said Nexus added about half a million new documents daily, sourced from a “major identity verification company,” implying that the hackers had near real-time access to the identity verification company’s systems.

The advert claims that “customer photos are displayed if available.” Krebs found that his own driver’s license was among the searchable records in the database, confirming that the data was authentic. Secretary of Defense Pete Hegseth was also among the people whose photos were listed on the identity search site.

A spokesperson for the Department of Defense did not immediately comment on the report.

Working with security researcher Zach Edwards, whose ID card was also stolen in the breach, Krebs identified the likely source as the identity verification service IDScan. The Louisiana-based company is relied on by major tech and consumer brands to verify tens of millions of people’s IDs around the world each month.

IDScan chief executive Jimmy Roussel did not return TechCrunch’s request for comment, but the company’s chief operating officer Jillain Kossman told Krebs that the company was investigating. Krebs said the FBI’s field office in New Orleans is also probing the breach. A spokesperson for the FBI did not respond to TechCrunch’s inquiry about the breach.

Nexus went offline shortly after Krebs’ report went live.

This data breach comes as governments are increasingly rolling out age verification laws, which largely rely on requiring adults to upload their identity documents to verify that they are old enough to enter a website or app. Security experts and privacy advocates have long warned that companies storing vast amounts of people’s identity documents for long periods of time put that data at risk of theft by hackers.

By all accounts, this would be the largest known single breach of identity documents in some time.