It sure looks like hackers breached a major ID card verification service

If you person handed implicit your driver’s license, passport, oregon different signifier of individuality papers to verify your accusation successful the existent world, similar astatine a bar, a weed store, oregon erstwhile booking a car rental, there’s a bully accidental it’s present been stolen successful a suspected monolithic information breach.

That’s according to a jaw-dropping report by autarkic information writer Brian Krebs, who says a institution utilized to verify government-issued individuality documents successful the existent satellite was apt hacked and its immense stores of people’s ID cards were exfiltrated.

Krebs reports that an individuality theft tract called Nexus, which launched connected the dark web this week, claimed to let users to hunt done much than 150 cardinal driver’s licenses and passports belonging to radical who unrecorded successful the United States and Canada. A station advertizing the tract connected a known Russian cybercrime forum said Nexus added astir fractional a cardinal caller documents daily, sourced from a “major individuality verification company,” implying that the hackers had adjacent real-time entree to the individuality verification company’s systems.

The advert claims that “customer photos are displayed if available.” Krebs recovered that his ain driver’s licence was among the searchable records successful the database, confirming that the information was authentic. Secretary of Defense Pete Hegseth was besides among the radical whose photos were listed connected the individuality hunt site.

A spokesperson for the Department of Defense did not instantly remark connected the report.

Working with information researcher Zach Edwards, whose ID paper was besides stolen successful the breach, Krebs identified the apt root arsenic the individuality verification work IDScan. The Louisiana-based institution is relied connected by large tech and user brands to verify tens of millions of people’s IDs astir the satellite each month.

IDScan main enforcement Jimmy Roussel did not instrumentality TechCrunch’s petition for comment, but the company’s main operating serviceman Jillain Kossman told Krebs that the institution was investigating. Krebs said the FBI’s tract bureau successful New Orleans is besides probing the breach. A spokesperson for the FBI did not respond to TechCrunch’s enquiry astir the breach.

Nexus went offline soon aft Krebs’ study went live.

This information breach comes arsenic governments are increasingly rolling retired property verification laws, which mostly trust connected requiring adults to upload their individuality documents to verify that they are aged capable to participate a website oregon app. Security experts and privateness advocates person agelong warned that companies storing immense amounts of people’s individuality documents for agelong periods of clip enactment that information astatine hazard of theft by hackers.

By each accounts, this would beryllium the largest known azygous breach of individuality documents successful immoderate time.