IDScan.net confirms breach after 153M+ driver's license scans offered on dark web

IDScan.net has confirmed that an unauthorized third party may have accessed or copied customer data in its cloud platform after scans of 153M+ US and Canadian driver's licenses, 10M+ ID cards, 3M+ travel documents, and 579,000+ medical cards appeared for sale…

A dark web identity theft service called Nexus, operating on the Exploit cybercrime forum, offered for sale or searchable access to more than 153 million scanned driver's licenses, primarily from the US and Canada, alongside over 10 million ID cards, more than 3 million travel documents, and at least 579,000 medical cards. KrebsOnSecurity traced the records to New Orleans-based identity verification provider IDScan.net, whose clients are variously reported as including Hertz, Target, FedEx, Motorola Solutions, Caesars Entertainment, Jack Henry, and cannabis dispensaries including Planet13 (Infosecurity Magazine reports 'hundreds of US cannabis dispensaries'; The Record says IDScan serves banks, cannabis retailers, and gun stores). The database reportedly includes the licenses of US Defense Secretary Pete Hegseth, FBI personnel, and journalist Brian Krebs. The operators claim exfiltration has been ongoing for over a year, with records growing by roughly 400,000 per day. The FBI's New Orleans field office opened a formal investigation, and Nexus went offline shortly after the story broke on 2026-09-04. At least four class-action lawsuits have been filed against IDScan.net in the US District Court for the Eastern District of Louisiana. In the latest development, IDScan.net published a breach notice on September 4 stating it learned around September 1 that an unauthorized third party may have accessed or copied customer information in its cloud platform, potentially including full names and government-issued ID numbers; the notice was reportedly hidden from search engine indexing. IDScan.net has not disclosed how many customers were affected and is offering free credit monitoring. Source confidence note: KrebsOnSecurity's tracing linked the data to IDScan.net (matching record timestamps to scans at Hertz rentals and Planet13), but SOCRadar reported as of 2026-09-07 that the breach's authenticity and source remained unconfirmed; IDScan.net had not issued an official statement as of 2026-09-04, said it was investigating as of 2026-09-07, and confirmed the potential cloud access in its September 4 notice as reported on 2026-09-10.

• Nexus, a dark web service on the Exploit cybercrime forum, offered 153M+ scanned US and Canadian driver's licenses, 10M+ ID cards, 3M+ travel documents, and 579,000+ medical cards.
• KrebsOnSecurity traced the records to New Orleans identity verification provider IDScan.net, matching record timestamps to scans at Hertz rentals and Planet13 dispensaries.
• Reported IDScan.net clients include Hertz, Target, FedEx, Motorola Solutions, Caesars Entertainment, Jack Henry, and cannabis dispensaries (one report says 'hundreds of US cannabis dispensaries'; another says banks, cannabis retailers, and…
• The database reportedly includes licenses of US Defense Secretary Pete Hegseth, FBI personnel, and journalist Brian Krebs.
• Operators claim exfiltration has been ongoing for over a year, with records growing by roughly 400,000 per day.
• The FBI's New Orleans field office opened a formal investigation; one report says the FBI formally requested information on the breach.
• Nexus went offline shortly after the story broke on 2026-09-04.
• At least four class-action lawsuits were filed against IDScan.net in the US District Court for the Eastern District of Louisiana.