If you have handed over your driver’s license, passport, or other forms of identity documents for verification at places like bars, weed stores, or car rental services, there’s a significant chance that your information has been compromised in a suspected massive data breach.
The Breach
According to a report by independent security journalist Brian Krebs, a company responsible for verifying government-issued identity documents appears to have been hacked, leading to the exfiltration of vast stores of people’s ID cards. An identity theft site named Nexus, which launched on the dark web this week, claims to allow users to search through over 150 million driver’s licenses and passports belonging to individuals in the United States and Canada.
A post advertising Nexus on a known Russian cybercrime forum stated that the site adds approximately 500,000 new documents daily, sourced from a "major identity verification company," suggesting that hackers had near real-time access to the company’s systems. The advertisement claims that "customer photos are displayed if available."
Confirmation of Data Authenticity
Krebs discovered that his own driver’s license was among the searchable records in the database, confirming the authenticity of the data. Notably, Secretary of Defense Pete Hegseth was also listed among the individuals whose photos appeared on the identity search site. A spokesperson for the Department of Defense stated that they are "aware of these reports and are evaluating them."
