FBI probes suspected IDScan breach of 153 million IDs

Hackers advertised searchable copies of about 153 million US and Canadian driver's licenses and passports on a dark-web marketplace called Nexus. The FBI is now looking into a suspected leak at a commercial ID-verification vendor.

TechCrunch picked the story up from Brian Krebs, who found his own license in the set. Secretary of Defense Pete Hegseth was listed too.

Krebs and researcher Zach Edwards pointed at Louisiana-based IDScan. The company has not confirmed a breach. COO Jillian Kossman told Krebs they were investigating. CEO Jimmy Roussel declined to comment to TechCrunch.

The FBI's New Orleans field office is on it. A spokesperson said the bureau is "looking into the incident" and would not say more. The Department of Defense said it is "aware of these reports and is evaluating them."

The 153 million figure is a snapshot. A post advertising Nexus on a known Russian cybercrime forum said the site added about 500,000 new documents a day from a "major identity verification company." Ars Technica said Dan Goodin's own license appeared within hours of a car-rental scan, and that Krebs watched the listing grow by almost 400,000 in 24 hours.

Nexus went offline shortly after Krebs published. Once the marketplace went dark, there was no public way for people to check whether their ID was in the set.

The suspected source looks like the same third-party pattern as the Thomson Reuters C-Track court-records incident: a vendor holding official documents for many customers, not the customer's own network. It also lands as governments push age-verification rules that send adults to upload IDs, the same retention fight sitting under Meta's youth settlement with the states.

No ransom note is public. Nobody has assigned a CVE. IDScan has not said it was breached.

Some offers on this page may be paid placements or contain affiliate links.