A newly launched dark web service called Nexus is selling access to what it claims are 150 million stolen U.S. and Canadian driver’s licenses and passports. Security journalist Brian Krebs reports the site allows searches by name and displays customer photos when available, confirming the authenticity of the data. The breach appears to originate from IDScan, a Louisiana-based identity verification company used by major brands to process tens of millions of ID checks monthly.
Krebs verified his own driver’s license and a photo of Secretary of Defense Pete Hegseth appeared in the database, prompting the Department of Defense to acknowledge awareness of the reports. IDScan’s COO confirmed an investigation is underway, while the FBI’s New Orleans field office is also probing the incident. Nexus went offline shortly after Krebs published his report.
The breach arrives as governments expand age-verification laws that require uploading identity documents, raising concerns about long-term storage risks. Security experts have long warned that centralized identity databases create attractive targets for hackers, and this incident may be the largest known breach of its kind in recent years.
