The breach, if confirmed, could be one of the largest exposures of government-issued identity documents in North America, creating risks of identity theft and fraud for millions.