Suspected ID Verification Breach Raises Alarm Over Driver’s License Data

TechCrunch reports that hackers appear to have breached a major ID card verification service, citing a report by independent security journalist Brian Krebs. The identity theft site Nexus claimed it could search through more than 150 million driver’s licenses and passports belonging to people in the United States and Canada. The site also claimed it added about half a million new documents daily, allegedly sourced from a “major identity verification company.”

The exposed records reportedly included government-issued identity documents such as driver’s licenses and passports, with customer photos displayed when available. Krebs found his own driver’s license in the database, and Secretary of Defense Pete Hegseth was also listed on the identity search site. If authentic at the scale claimed, the incident would represent a major risk because identity documents are difficult to replace and can be abused for identity theft.

Working with security researcher Zach Edwards, Krebs identified the likely source as IDScan, a Louisiana-based identity verification service. TechCrunch says IDScan is used by major tech and consumer brands to verify tens of millions of IDs around the world each month. IDScan’s chief operating officer told Krebs the company was investigating, while TechCrunch reported that its chief executive did not return a request for comment.

A Department of Defense spokesperson told TechCrunch it was aware of the reports and evaluating them. The FBI confirmed it is looking into the incident but declined to comment further. Nexus went offline shortly after Krebs’ report was published, but the broader questions around how long identity verification companies retain sensitive documents remain unresolved.

The report lands as governments increasingly roll out age-verification laws that can require adults to upload identity documents to access websites or apps. TechCrunch notes that security experts and privacy advocates have long warned that storing large volumes of identity documents creates a major target for hackers. The clearest takeaway: systems that collect IDs need strong safeguards, limited retention, and clear accountability when sensitive records are exposed.