IDScan confirms breach after 153 million driver's license scans offered for sale on dark web

Louisiana-based identity verification firm IDScan.net confirmed hackers accessed customer data in its cloud platform on or around September 1, 2026, after the Nexus dark web service began selling 153M+ US and Canadian driver's license scans, plus 10M ID…

IDScan.net published a breach notice on September 4, 2026 (hidden from search engine indexing), after learning around September 1 that an unauthorized third party may have accessed or copied customer information in its cloud platform, potentially including full names and government-issued ID numbers. KrebsOnSecurity tied the incident to Nexus, a Russia-linked dark web identity theft service advertised on the Exploit forum, which was offering 153M+ driver's license scans along with 10M ID cards, 3M+ travel documents, and 579,000 medical cards; Cyber Security News puts the total at 170M+ people's records. Nexus operators claim continuous exfiltration for over a year, with the license count growing by nearly 400,000 in 24 hours, suggesting the intrusion may still be active. The trove reportedly spans commercial licenses, Common Access Cards, medical and dispensary IDs, Canadian records exceeding 1.1 million (nearly 474,000 from Ontario), and a record for US Defense Secretary Pete Hegseth. The FBI's New Orleans field office has opened a formal inquiry, IDScan.net is cooperating with law enforcement, notifying affected individuals, and offering free credit monitoring, while multiple lawsuits have been filed; the company has not disclosed how many customers were affected. Nexus disappeared from the dark web shortly after the story published.

• IDScan.net detected unauthorized access to its cloud platform on or around September 1, 2026, and posted a breach notice on September 4 that was hidden from search engine indexing
• Nexus dark web marketplace advertised 153M+ US and Canadian driver's license scans for sale
• The listing also included 10M ID cards, 3M+ travel documents, and 579,000 medical cards; Cyber Security News reports 170M+ people's records in total
• Canadian records exceed 1.1 million, with nearly 474,000 from Ontario alone (per Cyber Security News)
• The trove reportedly includes commercial licenses, Common Access Cards, medical and dispensary IDs, and a record for US Defense Secretary Pete Hegseth
• Nexus operators claim continuous exfiltration for over a year, with the license count growing by nearly 400,000 in 24 hours, suggesting the intrusion may be active
• KrebsOnSecurity tied the leak to IDScan.net and verified its authenticity, prompting an FBI New Orleans field office investigation
• IDScan.net is notifying affected individuals, offering free credit monitoring, and cooperating with federal law enforcement; customer count affected has not been disclosed