Foreign media cited reports by independent security journalist Brian Krebs, stating that a service provider used for verifying government-issued identification documents is suspected of having been hacked, and a large number of driver's license and passport images may have been stolen. If this is indeed the case, it would be one of the largest single incidents of identity document leaks in recent years.

Dark web sites claim to possess a vast amount of documents and certificates

It was reported that a website known as Nexus that specializes in identity theft appeared on the dark web this week. The website claims to have access to over 150 million records of driver's licenses and passport information belonging to residents of the United States and Canada.

An advertisement posted on a Russian cybercrime forum claimed that these data came from “a large authentication company” and that about 500,000 new files are added daily. This claim suggests that the attackers may have had near-real-time access to the systems of the relevant company at some point.

The suspected source points to IDScan.

After comparing the leaked samples with security researcher Zach Edwards, Krebs believes that the Louisiana-based company IDScan may be the source of the data. This company provides identity document verification services for numerous technology and consumer brands, processing tens of millions of user verification requests globally each month.

TechCrunch stated that IDScan, the Chief Executive Officer, Jimmy Roussel did not respond to requests for comment. The company's Chief Operating Officer, Jillain Kossman, told Krebs that the company is investigating the matter.

FBI has been involved in the investigation.

The report also stated that the FBI's New Orleans field office has become involved in the investigation. FBI did not respond to requests for comment from TechCrunch. A spokesperson for the U.S. Department of Defense also did not immediately comment on the related reports.

At the time of this incident, governments in multiple regions were promoting age verification regulations, requiring adults to upload identification documents to prove their eligibility to access certain websites or applications. Security researchers and privacy advocates have long warned that the centralized storage of such a large volume of personal documents significantly increases the risk of data theft. Shortly after the report was published, Nexus was taken offline, but the actual extent of the data breach is still unclear.