September 6, 2026
Identity verification company IDScan is facing multiple lawsuits after hackers allegedly breached its systems and offered more than 153 million U.S. and Canadian driver’s licenses for sale on a dark-web identity theft service called Nexus. The breach, first reported by Brian Krebs on September 1, 2026, has triggered an FBI investigation and raised serious questions about how businesses protect sensitive identity data collected from everyday transactions.
What Happened: IDScan Data Breach Exposes 153 Million Driver’s Licenses
On September 1, 2026, investigative journalist Brian Krebs revealed that a dark-web service named Nexus was advertising access to over 153 million driver’s license scans, 10 million ID cards, 3 million travel documents, and 579,000 medical cards. Krebs verified the data by searching for his own records and tracking the source to IDScan, a Louisiana-based identity verification technology firm.
IDScan provides hardware and software used by car rental companies, retailers, gun shops, financial institutions, cannabis dispensaries, and hospitality businesses across the United States. Consequently, the breach has far-reaching implications for anyone who has presented government-issued identification at a business using IDScan’s technology.
Multiple law firms, including Markovits, Stock & DeMarco and Hall Attorneys, have launched class-action investigations. Furthermore, lawsuits filed in Louisiana allege IDScan failed to adequately protect client information. The FBI’s New Orleans office confirmed it is investigating the incident, though it declined further comment.
Technical Details of the IDScan Nexus Incident
The exact method of compromise remains unclear. IDScan has not issued any public statements or confirmed whether its systems were breached. However, the scale of the exposed data suggests either a direct compromise of IDScan’s storage infrastructure or a significant misconfiguration that left customer data accessible.
The dark-web service Nexus is no longer online. Nevertheless, cybersecurity experts emphasize that the underlying data remains in the hands of cybercriminals. The dataset includes:
- Over 153 million U.S. and Canadian driver’s license scans
- 10 million additional ID cards
- 3 million travel documents
- 579,000 medical cards
BleepingComputer also reported that the service included documents allegedly belonging to U.S. Secretary of Defense Pete Hegseth and an assistant director of the FBI, though this could not be independently verified.
Business and Operational Impact
The consequences of this breach are both immediate and long-term. For individuals, exposed driver’s license data enables identity theft, synthetic identity fraud, and targeted social engineering. For businesses, the incident damages trust and exposes them to regulatory scrutiny.
- Identity theft risk: Driver’s license numbers, dates of birth, and addresses are foundational to many identity verification processes in banking, healthcare, and government services.
- Class-action exposure: Multiple lawsuits have already been filed, and additional cases are expected. Historical precedent suggests settlements or judgments could reach tens of millions of dollars.
- Regulatory consequences: State attorneys general and federal regulators may launch separate investigations, as occurred with breaches at 23andMe, Marriott, and Equifax.
- Customer notification: IDScan reportedly began notifying some business customers around September 1. However, end consumers may remain unaware their data was exposed.
Mitigation and Recommendations
Immediate Actions for Affected Individuals
- Place a fraud alert or credit freeze with all three major credit bureaus (Experian, Equifax, TransUnion).
- Monitor bank and credit card statements closely for unauthorized activity.
- Enable two-factor authentication on all financial and government accounts.
- Be cautious of phishing emails or phone calls referencing driver’s license data.
- Request a replacement driver’s license if your state allows it after a data breach.
Actions for Businesses Using IDScan
- Review data retention policies and limit storage of sensitive identity documents.
- Assess vendor security practices and contractual liability for data breaches.
- Notify affected customers promptly if your organization used IDScan during the exposure window.
- Evaluate alternative identity verification providers with stronger encryption and access controls.
Long-Term Security Improvements
Organizations should adopt a zero-trust approach to identity data. This means encrypting data at rest and in transit, enforcing strict access controls, and conducting regular third-party security assessments. Moreover, businesses should minimize the data they collect and retain only what is legally necessary.
Bottom line: The IDScan breach is a stark reminder that identity verification vendors hold vast quantities of sensitive personal data. Organizations must treat this data as a high-value target and implement commensurate security controls. Individuals should assume their data is already compromised and take proactive steps to protect their financial and digital identities.
Incident Summary
| Incident: | IDScan Data Breach / Nexus Dark-Web Sale |
| Affected Records: | 153+ million driver’s licenses; 10 million ID cards; 3 million travel documents; 579,000 medical cards |
| Disclosure Date: | September 1, 2026 |
| Investigating Agency: | FBI New Orleans |
| Legal Status: | Multiple class-action lawsuits filed; additional investigations ongoing |
| Patch Status: | N/A — IDScan has not publicly confirmed breach details |
References
- Brian Krebs, “FBI Probes Service Selling 153M Driver’s Licenses,” Krebs on Security, September 1, 2026, https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/
- Sergiu Gatlan, “153 Million Driver’s Licenses Exposed in IDScan Data Breach,” BleepingComputer, September 2, 2026, https://www.bleepingcomputer.com/news/security/153-million-drivers-licenses-exposed-in-idscan-data-breach/
- Lawrence Abrams, “Dark Web Service Sells 153 Million Driver’s Licenses from IDScan Breach,” BleepingComputer, September 1, 2026, https://www.bleepingcomputer.com/news/security/dark-web-service-sells-153-million-drivers-licenses-from-idscan-breach/
