Massive Identity Verification Service Breach Exposes 150 Million Documents
A identity‑verification service that processes official documents for more than 150 million people in the United States and Canada has been breached, according to a report by security journalist Brian Krebs that details the leak of driver’s licenses and passports via a dark‑web site called Nexus, which claimed real‑time access to the data. The compromise involves IDScan, a Louisiana‑based firm that verifies identities for major tech and consumer brands, and even exposed the driver’s license of Secretary of Defense Pete Hegseth.
IDScan’s platform is built on a cloud‑native architecture that combines automated image capture, AI‑enhanced OCR, and a real‑time verification engine accessed through APIs used by bars, cannabis dispensaries, car‑rental agencies and social media platforms. By infiltrating IDScan’s servers, attackers were able to exfiltrate the live database, enabling Nexus to advertise the addition of roughly half a million new documents each day with near‑instantaneous access.
IDScan has secured funding from venture capital firms focused on cybersecurity and has reached a valuation exceeding $500 million, cementing its status as a leading global identity‑verification provider. Its reliance by major technology and consumer brands makes it a high‑value target, especially as regulatory pushes for age‑verification increase demand for such services.
The breach highlights the risks of centralizing vast troves of personal identity documents and raises questions about data‑retention policies, law‑enforcement response, and the broader industry’s move toward more secure, decentralized verification models; regulators and companies now face pressure to redesign age‑verification frameworks that minimize exposure to large‑scale data theft.