Hackers Likely Breached a Major ID Card Verification Service — and the Data Is Searchable

A suspected massive breach of identity documents puts driver's licenses, passports, and photos in the hands of criminals — and the FBI is investigating.

Published: 2026-09-05 Category: Quick Take Sources: TechCrunch

The breach

If you have handed over your driver's license, passport, or other form of identity document to verify your information in the real world — at a bar, a weed store, or when booking a car rental — there's a good chance it has now been stolen in a suspected massive data breach.

The suspected source is IDScan, a company that verifies identity documents for businesses. A dark-web identity search site, Nexus, advertised the stolen records, claiming that "customer photos are displayed if available." Security researcher Brian Krebs found his own driver's license among the searchable records, confirming the data was authentic. Secretary of Defense Pete Hegseth was also among the people whose photos were listed on the identity search site.

The response

IDScan's chief operating officer Jillian Kossman told Krebs the company was investigating. The FBI's field office in New Orleans is probing the breach, and a spokesperson confirmed the bureau is "looking into the incident." The Department of Defense said it is "aware of these reports and is evaluating them." Nexus went offline shortly after Krebs' report went live.

By all accounts, this would be the largest known single breach of identity documents in some time.

Why it matters

Identity verification has become a ubiquitous, invisible layer of modern life. Every bar that scans an ID, every car rental counter, every age-gated store relies on third-party services like IDScan to confirm who you are. The trade-off has always been implicit: convenience and compliance in exchange for handing over your most sensitive documents to a company you've never heard of.

This breach exposes the fragility of that model. A single compromised vendor can expose the identity documents of millions of people — and because the data includes photos and document images, it is far more damaging than a leaked password. Stolen identity documents enable fraud, account takeover, and synthetic identity creation at a scale that a simple credit-monitoring alert cannot address.

The takeaway

The IDScan incident is a reminder that the identity-verification industry has become a high-value target precisely because it centralizes the exact data criminals want most. The response — an investigation, a dark-web site going dark — is reactive. The structural problem remains: too much sensitive identity data is concentrated in too few lightly-regulated vendors, with too little transparency about how it is stored and protected.

Source: TechCrunch — "It sure looks like hackers breached a major ID card verification service" (Sept 2, 2026).