FBI probes IDScan.net breach after 153 million licenses hit dark web

Key points

• FBI New Orleans field office opened an official inquiry into the breach after Krebs reported the incident on September 1.
• The dark web service Nexus listed over 153 million driver’s licenses, 10 million ID cards, and 3 million travel documents for sale.
• IDScan.net, headquartered in Metairie, Louisiana, confirmed an unauthorized third party accessed customer data, including names and government ID numbers.
• The breach affected clients including Hertz, Target, FedEx, and marijuana dispensaries, with data timestamps linking to car rentals and dispensary visits.
• IDScan.net is offering free credit monitoring to potentially impacted individuals and has secured its systems with third-party specialists.

Background

This incident follows earlier reports in early September 2026 regarding a similar breach involving up to 160 million IDs. Previous coverage highlighted the risks of outsourcing identity verification to third-party vendors and the potential exposure of government-issued IDs. The current investigation focuses on IDScan.net, which processes over 21 million verifications monthly for various industries.

How outlets are covering it

Krebs on Security provided detailed technical analysis, linking the breach to IDScan.net through timestamps on license scans that matched car rental and dispensary visits. Krebs noted that the Nexus service claimed to be continuously exfiltrating data for over a year. Fox 8 Live reported the FBI’s confirmation of the investigation and IDScan.net’s official statement regarding the breach. While both sources agree on the scale and the involvement of IDScan.net, Krebs emphasized the specific mechanisms of data collection, whereas Fox 8 focused on the official responses from the FBI and the company. IDScan.net’s statement acknowledged the breach but did not provide specific details on the scope beyond confirming unauthorized access to certain customer information.

Why it matters

This breach exposes millions of Americans to identity theft, as driver’s licenses are commonly used to open lines of credit and verify identity. The incident highlights vulnerabilities in third-party identity verification systems used by major corporations and government agencies. It also raises concerns about the security of sensitive personal data stored in cloud services and the potential for misuse by cybercriminals. The disappearance of the Nexus service suggests a possible takedown or shift in the dark web market, but the data may still be in circulation.

What to watch

The FBI is expected to continue its investigation into the breach and the source of the leaked data. IDScan.net is working with third-party specialists to determine the full scope of the incident and is notifying potentially impacted individuals. The company is offering free credit monitoring services to those affected. Regulatory bodies may scrutinize IDScan.net’s security practices and the broader industry’s reliance on third-party verification systems. Individuals whose data may have been compromised are advised to monitor their credit and report any suspicious activity.