IDScan Suspected in Breach Exposing 150 Million IDs
Dark web site Nexus claimed 150 million US and Canadian IDs, with evidence pointing to IDScan as the source. The FBI and company are now investigating.
Summary
On September 2, 2026, dark web identity theft site Nexus claimed searchable access to more than 150 million US and Canadian driver’s licenses and passports, including customer photos where available. An advertisement on a Russian cybercrime forum said about 500,000 documents were added daily from a major identity verification company, suggesting near real-time system access. Brian Krebs confirmed his license was present; Secretary of Defense Pete Hegseth and security researcher Zach Edwards also appeared in the data.
Krebs and Edwards identified Louisiana-based IDScan as the likely source. Major technology and consumer brands use IDScan to verify tens of millions of identities worldwide each month, including documents presented at bars, cannabis retailers and car rental businesses. Chief operating officer Jillian Kossman said IDScan was investigating, while chief executive Jimmy Roussel did not comment. The FBI’s New Orleans field office is probing the suspected breach, and the Department of Defense is evaluating the reports. Nexus subsequently went offline. If confirmed, this would be the largest known single identity-document breach in some time, intensifying concerns as expanding age-verification laws require more adults to upload IDs to websites and apps.
Positives
- Nexus went offline shortly after details of its claimed 150 million-document database became public.
- The FBI’s New Orleans field office is probing the suspected breach involving Louisiana-based IDScan.
- IDScan chief operating officer Jillian Kossman confirmed that the company was investigating the incident.
- The Department of Defense is evaluating the exposure after Secretary of Defense Pete Hegseth appeared in Nexus records.
Risks & concerns
- Nexus claimed access to more than 150 million US and Canadian driver’s licenses and passports.
- About 500,000 new documents were allegedly added daily, suggesting near real-time access to the source company’s systems.
- Customer photos were available in some records, increasing their potential value for identity theft and impersonation.
- IDScan verifies tens of millions of identities worldwide each month for major technology and consumer brands.
- Expanding age-verification laws could place more identity documents in centralized systems vulnerable to theft.