170 Million Identification Documents Put on the Dark Web
It was reported last month that the identification documents of 170 million North Americans—the vast majority of them from people in the U.S.—were made available on a dark-web service called Nexus (Nexus has subsequently been deactivated). Among the individuals whose documentation seems to have been stolen were Secretary of Defense Pete Hegseth, an assistant director of the Federal Bureau of Investigation (FBI), and other senior American officials.
Brian Krebs, a long-time reporter who writes on the blog Krebs on Security, broke the story and trace the breach back to the identification service called IDScan, which partners with such companies as Hertz, Fedex, and Target. IDScan has subsequently acknowledged that a breach occurred sometime earlier this year. The FBI has begun an investigation into the incident.
The lesson of the Nexus incident is simple: no service, not even a dedicated identification service, is immune to hacks, leaks, and other data incidents. Any policy that would require Americans to verify their age or identity comes with inherent privacy tradeoffs—and serious ones. These tradeoffs must be weighed, and with every new data breach, the costs of imposing such policies become greater.
Lawmakers must come to understand that privacy is indispensable to modern life. It would be impossible to eliminate all privacy risks, but it would be foolish to force Americans to provide identity documentation when not absolutely necessary.
Published on October 13, 2026