A suspected massive data breach has left millions of people’s identity documents exposed, with a site called Nexus advertising access to over 150 million driver’s licenses and passports from the US and Canada. Independent security journalist Brian Krebs reports that his driver’s license and even that of Secretary of Defense Pete Hegseth were among the stolen data. The breach is linked to IDScan, a company that verifies identities for major tech and consumer brands.

The incident comes as governments worldwide push for age-verification laws, potentially making such data breaches more frequent. Security experts warn that storing vast amounts of personal data increases the risk of theft. The FBI is investigating the breach, and IDScan is currently under scrutiny.

Krebs worked with security researcher Zach Edwards to identify the likely source of the breach. IDScan’s chief operating officer told Krebs the company is investigating the situation. The Louisiana-based firm is responsible for verifying tens of millions of IDs globally each month.

This would be the largest known single breach of identity documents in recent history, raising serious concerns about privacy and data security. As more personal data becomes digital, the risk of such breaches only grows. The future of identity verification may need to find a balance between convenience and security.