ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “identity verification”

23 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllData breach 28Phishing & fraud 26Industry 14Research 13AI safety & security 13Threat actor 8Advisory 7Malware 6Exploit / PoC 6AI research 5AI industry 4Policy & legal 4Tools 3Vulnerability 2
SeverityAllcritical 17high 31medium 37low 2info 57

FBI Probes Service Selling 153M+ Drivers Licenses

Dark web service Nexus sells scans of 153M+ US and Canadian drivers licenses, apparently siphoned from a breached identity verification company; FBI opened an inquiry.

A new dark web identity theft service called Nexus, advertised on the Exploit forum, offers scans of more than 153 million drivers licenses from the US and Canada, plus over 10 million ID cards and millions of travel and medical documents. The data appears to come from an ongoing breach at a major Louisiana-based identity verification company, with records growing by roughly 400,000 in 24 hours. Records include high-ranking US officials such as Defense Secretary Pete Hegseth, and timestamps suggest data was captured during car rentals and travel. The FBI's New Orleans field office has launched an official inquiry into the source of the images.

Krebs on Security · 15d agoData breach in the wild1

Srsly Risky Biz: America's Drivers Licence Breach is a National Security Disaster

Dark web service Nexus sold 153 million US and Canadian driver's licenses, linked to identity verification firm IDScan under FBI investigation.

Krebs On Security reported that a dark web service called Nexus sold access to 153 million US and Canadian driver's licenses, claiming over a year of continuous exfiltration from a major identity verification company, with roughly 400,000 new licences added in a single day. Krebs verified the data as genuine and linked the incident via circumstantial evidence to identity verification firm IDScan, whose licences of senior US officials including Secretary of War Pete Hegseth appeared in the database; the FBI is investigating and IDScan has confirmed a breach inquiry. The article argues the data has national security implications, citing how Chinese APT espionage (Anthem, Equifax, Marriott, OPM) and Bellingcat investigations exploited leaked databases. Class action suits are being prepared, and the piece calls for stricter oversight of identity verification firms.

Risky Business News · 7d agoData breach in the wild

FBI Probes Possible Breach of 153 Million Driver’s Licenses

FBI investigates possible breach exposing up to 170M North American driver's licenses, data sold on Exploit forum via 'Nexus' service, linked to IDScan.net.

The FBI is investigating a potentially massive breach of identity data affecting as many as 170 million North Americans, first reported by Krebs. The 'Nexus' service on the Exploit cybercrime forum claimed to hold over 153 million US and Canadian driver's licenses plus ID cards, travel documents, and medical cards, sourced from an active breach at a major identity verification company. Krebs linked the trove to New Orleans-based IDScan.net, which is investigating. The service went dark shortly after publication; experts warn stolen license data (DOB, address, ID numbers) can't be changed and could enable lifelong identity fraud.

Infosecurity Magazine · 14d agoData breach in the wild

IDScan Confirms Data Breach Following 153 Million Driver’s Licenses Leaked on the Dark Web

IDScan.net confirms a breach after a marketplace advertised over 153 million US and Canadian driver's licenses, possibly exfiltrated continuously for over a year.

The Louisiana identity-verification firm detected unauthorized access on or around September 1, 2026, after the 'Nexus' identity theft service on the Exploit forum began advertising 170M+ people's records, including 153M+ driver's licenses, 10M+ ID cards, 3M+ travel documents, and 579,000 medical cards. Canadian records exceed 1.1 million, and the trove includes commercial licenses, Common Access Cards, and dispensary IDs, with a record for US Defense Secretary Pete Hegseth reportedly included. Nexus operators claim continuous exfiltration for over a year, with the license count growing by nearly 400,000 in 24 hours, suggesting the intrusion may be active. The FBI's New Orleans field office has opened a formal inquiry, and IDScan.net is offering free credit monitoring.

Cyber Security News · 6d agoData breach in the wild 4 sources

153M+ driver’s licenses for sale on new dark web platform

New dark web platform Nexus is selling 153 million driver's license scans; FBI investigates apparent breach of IDScan.net.

A dark web platform called Nexus claims to sell more than 153 million driver's license scans, 10 million ID cards, 3 million travel documents, and 579,000 medical cards including marijuana dispensary cards. KrebsOnSecurity linked the trove to identity verification provider IDScan.net, with records reportedly containing front-and-back images plus infrared and ultraviolet scans and timestamps matching holders' travel or car-rental activity. The FBI's New Orleans field office opened an investigation into the apparent breach; IDScan.net says it is investigating.

Malwarebytes Labs · 15d agoData breach1

America's Driver's License Breach Is a National Security Disaster

Dark web service Nexus sells 153 million US/Canadian driver's licenses linked to a breach of identity verifier IDScan.

Krebs on Security revealed a dark web service, Nexus, selling access to 153 million driver's licenses and 3 million travel documents from US and Canadian citizens, roughly 63 percent of all US licenses. Circumstantial evidence links the data to identity verification firm IDScan, which confirmed it is investigating a breach, and the FBI is probing the incident. Licenses belonging to senior US officials, including Pete Hegseth, an FBI assistant director, and Krebs's own contacts were verified as genuine. The exfiltration appears ongoing, with the database growing by nearly 400,000 licenses in a single day, and the data carries significant national security value for foreign intelligence services.

Hacker News · security · 1d agoData breachHN 26↑ · 4 comments3· 1 read

It sure looks like hackers breached a major ID card verification service

Suspected breach of ID verification firm IDScan exposed over 150 million US and Canadian driver's licenses and passports, sold via dark web site Nexus.

Independent journalist Brian Krebs reported that a dark web site called Nexus is selling searchable access to more than 150 million driver's licenses and passports belonging to people in the United States and Canada, adding roughly 500,000 documents daily from a 'major identity verification company.' Krebs and researcher Zach Edwards identified Louisiana-based identity verification service IDScan as the likely source; Krebs' own license and Defense Secretary Pete Hegseth's records appeared in the database. The FBI confirmed it is looking into the incident and IDScan says it is investigating; Nexus went offline shortly after the report went live.

TechCrunch · Security · 14d agoData breach in the wild

Dark Web Service Nexus Sells 153M+ Driver's Licenses

Dark web service Nexus offered 153M+ US and Canadian driver's license scans, traced to suspected IDScan.net breach; the FBI opened an investigation.

A dark web identity theft service called Nexus began offering searchable access to more than 153 million scanned US and Canadian driver's licenses, plus 10M+ ID cards, 3M+ travel documents, and 579,000+ medical cards. KrebsOnSecurity traced the records to New Orleans identity verification firm IDScan.net, whose clients include Hertz, Target, FedEx, Motorola Solutions, Caesars Entertainment, Jack Henry, and Planet13 dispensaries. The FBI's New Orleans field office opened a formal investigation, and Nexus went offline soon after the story broke. Operators claim exfiltration has been ongoing for over a year, with records growing by roughly 400,000 per day.

Security Affairs · 13d agoData breach

88 ID Verification Breaches Show the Cost of Collecting Identity Data

A report catalogs 88 ID-verification breaches since 2011 exposing at least 2.15 billion records, with 41 incidents leaking irreplaceable biometric data and documents.

A Mysterium VPN report compiles 88 documented breaches since 2011 involving identity and age-verification data, with confirmed exposure of 2.15 billion records and claimed totals of 4.54 billion. In 41 of 88 incidents, ID scans, verification selfies, fingerprints, and biometric templates leaked, data that cannot be changed after exposure. Notable cases include the Tea app's exposed selfies, Discord's ~70,000 government IDs, vendor failures at AU10TIX, Sumsub, and Persona, and national registry breaches in Argentina (45 million records) and France (11.7 million people).

Security Affairs · 22d agoData breach

ShinyHunters claims Florida DMV breach, puts data on the clock

ShinyHunters claims it breached Florida DMV's DAVID database, stole 200,000+ driver records including SSNs, and set a September 11 extortion deadline.

The ShinyHunters extortion group claims it breached the Florida Department of Highway Safety and Motor Vehicles' DAVID driver and vehicle database and stole more than 200,000 records. As evidence it published a screenshot of a Jeffrey Epstein record showing address, Social Security number, date of birth, license number and registered vehicles, and set a September 11 deadline before publication. The group says it obtained access through a password-reset weakness, compromised employee accounts, and queried and downloaded driver records and images. The Florida DMV has not confirmed the claim; it follows a separate confirmed IDScan.net breach exposing over 153 million license scans that prompted an FBI investigation.

CSO Online · 8d agoData breach in the wild1

IDScan confirms breach after hackers offer 153 million driver’s license scans for sale

IDScan confirmed hackers accessed customer data in its cloud after scans of roughly 153 million driver's licenses surfaced for sale on a dark web marketplace.

IDScan.net published a breach notice on September 4, after learning around September 1 that an unauthorized third party may have accessed or copied customer information in its cloud platform, potentially including full names and government-issued ID numbers. KrebsOnSecurity tied the incident to Nexus, a Russia-linked dark web marketplace selling access to over 153 million US and Canadian driver's license scans, plus 10 million ID cards, more than 3 million travel documents, and at least 579,000 medical cards. The company did not disclose how many customers were affected, is offering free credit monitoring, faces multiple lawsuits, and the FBI has opened an inquiry. IDScan's government ID authentication is widely used by banks, cannabis retailers, and gun stores.

The Record · 6d agoData breach in the wild

Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks

Revolut handed over KYC documents, selfies, and Bitcoin transaction histories to attackers after a fraudulent email from a genuine government domain passed authentication checks.

Revolut confirmed on September 12, 2026 that it disclosed sensitive customer KYC data to an unauthorized third party after a fraudulent information request was sent from an email account operating inside a real government agency's domain, carrying valid domain authentication credentials. The exposed data included identity documents (passports, driver's licenses), verification selfies, birth dates, contact details, IBANs, account statements, and full transaction histories including Bitcoin. Revolut discovered the fraud only after independently verifying with the agency, blocked the sender, and notified law enforcement and financial regulators, but did not disclose the number of affected customers or the agency involved. Researcher ZachXBT assessed the operation was targeted at high-net-worth users, useful for fraud, impersonation, or extortion.

Security Affairs · 4d agoData breach

Revolut Data Breach Exposes Customers’ Passport Copies and Full Transaction Histories to Hackers

Revolut leaked KYC documents and full transaction histories after a fraudulent, domain-authenticated email request impersonating a government agency.

Revolut disclosed that an attacker using an unauthorized email account on a legitimate government domain, with valid domain-authentication credentials, tricked the fintech into releasing customer data. The exposed data includes passport and driver's license copies, identity-verification selfies, full names, dates of birth, addresses, IBANs, and complete transaction histories including Bitcoin activity. Revolut says core systems, accounts, and funds were not compromised, and it blocked the email source and notified authorities. On-chain investigator ZachXBT and others indicated the operation targeted high-net-worth users facing elevated phishing, SIM-swap, and extortion risk.

Cyber Security News · 4d agoData breach3· 1 read

Hackers publish thousands of drivers’ data after breaching Florida motor vehicle database

ShinyHunters published hundreds of thousands of records from Florida's DAVID vehicle database, including SSNs and passports, after an unpaid ransom demand.

The ShinyHunters group published hundreds of thousands of files from Florida's DAVID motor vehicle database on its leak site, saying the victim did not pay a ransom. Stolen records include vehicle ownership certificates with names, addresses, and VINs, plus a smaller number of Social Security numbers, non-US passports, and immigration documents. FLHSMV confirmed the breach, which followed theft of a police officer's credentials stored on a personal device. It comes the same month as the IDScan hack exposing over 150 million driver's license images.

TechCrunch · Security · 19h agoData breach 3 sources

FBI investigates breach of 153 million driving license records at IDscan.net

Scans of 153 million driver's licenses, traced to IDscan.net and including Pete Hegseth and Brian Krebs, were offered for sale on the dark web.

Digital scans of 153 million driver's licenses appeared for sale by a user on the Russian cybercrime forum Exploit, alongside over 10 million ID cards, 3 million travel documents, and 579,000 medical cards sold through a site called Nexus. KrebsOnSecurity traced the leak to identity verification provider IDscan.net, whose customers include car rental company Hertz, and victims reportedly include US Defense Secretary Pete Hegseth. The FBI has opened an official inquiry into the source of the images, and IDscan.net has not issued an official statement.

CSO Online · 12d agoData breach1

Beyond the Perimeter: Building Resilience Against Cloud and SaaS Supply-Chain Attacks

ShinyHunters exploited an Oracle PeopleSoft zero-day to steal data and extort roughly 100 organizations, including the Council of Europe, for up to $2.3M.

Between May and early June 2026, the ShinyHunters group exploited a critical zero-day in Oracle PeopleSoft across about 100 organizations and 300 instances worldwide, per reports cited by The Register. Stolen records included employee and student personal data, payroll, tax, financial and health information, plus immigration and passport documents. AgentCypher.ai estimates extortion demands of $400,000 to $2.3 million per victim, typically in Bitcoin; the Council of Europe refused to pay. The article uses the incident to argue for Zero Trust, supply-chain risk management, rapid patching, encrypted distributed backups and defined recovery-time objectives.

Cyber Security News · 5d agoData breach in the wild1

Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far

TechCrunch's 2026 roundup covers SSA data exposure, Iranian water-utility attacks, Klue breach hitting ~200 firms, and Meta AI chatbot account hijacks.

TechCrunch's mid-year roundup highlights a whistleblower claim that DOGE uploaded a live Social Security database copy to an unsecured third-party server, which House Democrats called potentially the largest US breach in history. CISA reported Iranian hackers targeted over 100 US water providers over the summer, while Russian-linked attacks hit Polish, Swedish, and Norwegian energy and water infrastructure. Market research firm Klue was breached via a stale 2022 pilot credential, exposing cloud keys of ~200 customers including Jamf, HackerOne, and LastPass to extortion gang Icarus. Separately, tens of thousands of Instagram accounts were hijacked by abusing Meta's AI chatbot to trigger password resets to attacker-controlled emails.

TechCrunch · Security · 1d agoData breach in the wild

Revolut discloses data breach exposing financial info, passports

Revolut disclosed a breach after a threat actor spoofing a government agency's email domain obtained customer passports, selfies, IBANs, and full transaction histories.

Revolut told affected customers that a threat actor sent a data request from an unauthorized email account on an official government agency's domain, carrying valid domain authentication credentials, and staff fulfilled it believing it legitimate. Exposed data includes identity details, contact information, passport and driver's license copies, KYC facial verification selfies, IBANs, withdrawal records, and full transaction histories including Bitcoin. Revolut calls the number of affected customers 'very limited' but refuses to give exact figures, while ZachXBT says high-net-worth users appear targeted. This follows a 2022 Revolut breach affecting 50,150 customers.

BleepingComputer · 3d agoData breach1· 1 read

Revolut Data Breach Via Fake Government Requests – What We Know So Far

Revolut confirmed attackers extracted customer KYC records by sending fraudulent data requests from a spoofed or compromised government agency email domain.

Revolut confirmed a data breach in which an unauthorized party obtained sensitive customer records by submitting fraudulent information requests from an email account on a legitimate government agency domain with valid SPF/DKIM/DMARC authentication. Disclosed data could include full names, dates of birth, passport or driving-license copies, onboarding facial images, IBANs, account statements, withdrawal records, and complete transaction histories including Bitcoin activity. Crypto investigator ZachXBT assessed the operation targeted high-net-worth users, while a threat actor using the name 'IAmNotAVillain' claimed Italian law-enforcement departments were compromised over six months with 147 GB of material, claims that remain unverified. Revolut says only a limited number of customers were affected, blocked the email address, and notified regulators and affected customers, stating its systems and funds were not compromised.

Cyber Security News · 2d agoData breach

Revolut Data Leak May Trace Back to Compromised Italian Government Accounts

Attackers using a compromised Italian government PEC account impersonated law enforcement to obtain data on ~680 Revolut customers.

Revolut confirmed its systems were not breached; fraudulent data requests came from a compromised PEC mailbox tied to the Prefecture of Reggio Calabria on the pec.interno.it domain. Per the Financial Times, roughly 680 customers had identity documents, addresses, banking information, verification selfies and cryptocurrency transaction histories exposed. Researcher Korra of Duel described a 'spray and pray' operation using hundreds of crypto transaction IDs and fraudulent European Investigation Orders. Threat actor IAmNotAVillain claims six months of access and 147 GB exfiltrated from Italian law-enforcement systems, though this remains unverified.

Security Affairs · 1d agoData breach in the wild

What we know about the Revolut data breach so far

Revolut confirmed an impersonation scheme exposed high-net-worth customers' identity documents, IBANs, and transaction histories to an attacker.

Revolut confirmed on September 12 that someone impersonating a government agency, using an email address on that agency's domain, obtained sensitive customer records. Exposed data includes birth dates, postal and email addresses, phone numbers, passport and driving licence copies, verification selfies, account statements, and transaction histories; ZachXBT added that IBANs, withdrawal records, occupations, and bitcoin transaction history were also included. Revolut says a limited number of customers were affected, the sender's address was blocked, and its systems and customer funds were untouched, with law enforcement and regulators notified.

Help Net Security · 3d agoData breach1

Revolut gave customer IDs and financial data to a government impostor

Revolut handed customer IDs, selfies, and financial records to criminals using a legitimate government agency email domain.

Revolut acknowledged disclosing sensitive customer records after accepting fraudulent information requests sent from an email address on a legitimate government agency domain, describing it as an external impersonation scam rather than a system intrusion. The London-based fintech, which serves more than 80 million customers globally, says customer funds were not affected and only a 'very limited' number of customers were impacted. Disclosed data includes identity and contact information, copies of passports and driver's licenses, verification selfies, account statements, and transaction histories. Revolut blocked the sending address and notified the relevant agency, law enforcement, data protection authorities, and financial regulators.

Malwarebytes Labs · 3d agoData breach

Revolut confirms customer data breach through fake government requests

Revolut disclosed customer identity data, including passports and possibly selfies, to an attacker using a legitimate government email domain.

Attackers impersonating a government agency used a legitimate agency email domain to submit fraudulent information requests, prompting Revolut to disclose customer identity and contact data to an unauthorized third party. Exposed data included birth dates, postal and email addresses, phone numbers, passport and driver's license copies, and possibly verification selfies, account statements, and transaction histories. Revolut said a limited number of customers were affected, blocked the email address, and notified the agency, law enforcement, and regulators, adding that systems and customer funds were unaffected. Security researcher ZachXBT reported the scam appeared to target high net worth users of the fintech, which serves over 80 million customers.

TechCrunch · Securityupdated · 3d agofirst · 4d agoData breach in the wild 3 sources3