IDScan Likely Hacked, Exposing More Than 150 Million Identity Documents

A suspected data breach at identity verification service IDScan may have exposed more than 150 million driver’s licenses and passports belonging to people in the United States and Canada.

Independent security journalist Brian Krebs reported that an identity theft site called Nexus claimed to let users search the documents. An advertisement on a known Russian cybercrime forum said Nexus added about half a million new documents daily from a “major identity verification company,” suggesting near real-time access to the company’s systems. The advertisement said customer photos were displayed when available.

Krebs found his own driver’s license in the database, confirming that the records were authentic. Secretary of Defense Pete Hegseth was also among the people whose photos were listed.

Working with security researcher Zach Edwards, Krebs identified IDScan as the likely source. The Louisiana-based company verifies tens of millions of identities for major technology and consumer brands around the world each month. IDScan chief executive Jimmy Roussel did not respond to TechCrunch, while chief operating officer Jillain Kossman said the company was investigating.

The FBI’s field office in New Orleans is also probing the incident, according to Krebs. Nexus went offline shortly after the report was published.