ID Verification Breach Exposes Millions of Sensitive Identity Documents

By edisonreed // 2026-09-04

Mastodon

Parler

Gab

Copy

A dark-web service advertised on Aug. 31 is offering over 153 million scans of driver's licenses, more than 10 million other identity cards, over three million travel documents and/or international IDs and at least 579,000 medical cards, according to a report by security researcher Brian Krebs. [1] The service, called Nexus, was advertised on the Russian-language cybercrime forum Exploit. [1] Krebs reported that a blank search on Nexus returned about 11.5 million result pages with roughly 15 results per page, which would support the claim that there were over 153 million license scans in the database. [1] The data appears to stem from a company hired to verify people's identities, according to the report. [1] TechCrunch reported that the suspected breach involves a company used to verify government-issued identity documents in the real world. [2]

Data Includes Verified Timestamps and Diverse ID Types

Krebs was able to verify that his own Virginia license was among those available on the site, according to the report. [1] He searched with permission for the licenses of more than a dozen friends and relatives. Nine people whose records appeared said that the attached timestamps matched or closely tracked their travels. [1] In the case of Krebs and his mother, the timestamps corresponded to a June 2025 car rental from Hertz, and their records were created seconds apart – matching their account that they handed both licenses to the rental representative at the same time. [1] The report stated that each record contained three pairs of images showing the front and back of the license in visible light, infrared, and ultraviolet. [1] Privacy researcher Zach Edwards also found his license on Nexus, according to the report. [1] Its timestamp matched a trip to Las Vegas, where he had presented the document to the Transportation Security Administration, the Aria hotel and the Planet13 dispensary. Edwards said the dispensary was the only one of the three places where he knew the license had been scanned. [1] IDScan.net, a Louisiana-based company, announced an exclusive identity verification agreement with Planet13 in 2022, according to the report. [1] The company says it provides verification for more than 1,000 marijuana dispensaries in 19 states. [1] The incident illustrates the risks of centralized identity verification, a concern that some researchers have noted in the context of a broader push for digital ID systems. [8]

IDScan.net Declines Comment as FBI Opens Investigation

IDScan.net's website states that global brands use its technology at more than 20,000 locations and that its systems conduct more than 21 million verifications each month, according to the report. [1] The company's pages name Hertz, FedEx, Caesars Entertainment, Target, Motorola Solutions and Jack Henry among its customers or brands using its technology. [1] IDScan.net spokesperson Jillian Kossman told Krebs: "At this point I'm not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team's investigation." [1] The Federal Bureau of Investigation's (FBI) New Orleans field office opened an official investigation on Sept. 1 into an apparent breach involving IDScan.net, according to the report. [1] The report also stated that Nexus records included the license of Secretary of War Pete Hegseth and an assistant director of the FBI. [1]

Officials and Researchers Cite Risks in Growing Identity Verification Use

The breach highlights security concerns around government and corporate mandates for identity verification, which privacy advocates have previously flagged, according to statements from researchers. [1] Reclaim The Net reported that the incident provides evidence that assumptions about document security in the push to make people show ID are reckless. [1] Krebs noted that the data on Nexus appeared to grow by nearly 400,000 records in 24 hours, suggesting ongoing exfiltration, though he cautioned that Nexus's claim of continuous collection over a year is unverified. [1] The investigation into IDScan.net is ongoing, and no official confirmation of the breach's source or full scope has been provided, according to the FBI and company statements. [1] The incident adds to documented cases of centralized identity databases becoming targets, experts said, without drawing broader policy conclusions. [1] Concerns about the concentration of personal data in single repositories have been raised in the context of other breaches, such as one that exposed 5.6 million Americans through a credit verification service. [6]

Surveillance Aspirations Meet Data Breach Realities

The breach occurs as governments and corporations push for expanded identity verification regimes, often framed as child safety measures. [4] Missouri Gov. Mike Kehoe (R) signed House Bill 1839 on July 9, turning an attorney general rule into law that requires ID checks for certain online content. [4] In Washington, D.C, the House passed H.R. 7757, the Kids Internet and Digital Safety (KIDS) Act, by a vote of 267 to 117. [3] The bill bundles more than a dozen separate bills, including a House version of the Kids Online Safety Act, according to the report. [3] The centralized collection of identity documents required by such laws creates large targets for attackers. [9] The consequences of a breach go beyond financial fraud, as the mishandling of identity data can have long-term implications for those affected. [7] A prior breach at Discord involving a third-party customer support system left approximately 70,000 users with their government-issued identification photos exposed. [7]

Conclusion

The discovery of a massive trove of identity documents on the dark web has prompted an FBI investigation and raised questions about the security practices of companies that collect sensitive personal data. [1] The incident underscores the inherent risks of centralized identity verification systems that store large amounts of personal information in single repositories. [6] While the full scope of the breach remains under investigation, the event provides a case study for those concerned about proposals to expand identity verification requirements across more sectors of society. [5] The system of "showing your papers at every move you make" is being sold by politicians as a safety measure, but this breach demonstrates the consequences when such centralized databases fail. [1]

References

Ken Macon. "ID Verification Breach Exposes Millions of Sensitive Identity Documents". Reclaim The Net. September 2, 2026.
TechCrunch. "It sure looks like hackers breached a major ID card verification service". September 2, 2026.
Reclaim The Net. "The KIDS Act's Next Stop Is the Senate. Make Your Voice Count.". July 1, 2026.
Reclaim The Net. "Missouri Age Verification Law Signed by Governor Mike Kehoe". July 17, 2026.
Reclaim The Net. "The Age Verification Con". March 27, 2026.
Reclaim The Net. "700Credit Data Breach Exposes 5.6 Million Americans, Showing Risks of Centralized Digital ID Systems". December 15, 2025.
NaturalNews.com. "Discord breach exposes 70,000 government IDs through age verification vendor". October 10, 2025.
Laura Harris. "Coinbase breach exposes flaws in digital ID systems as governments push for centralized identity data". NaturalNews.com. May 20, 2025.
Shermin Voshmgir. "Token Economy How the Web3 reinvents the Internet".

Explainer Infographic