IDScan.net Breach Exposes 153 Million Driver's Licenses to Dark Web

Key points

• IDScan.net, a Louisiana-based identity verification company, confirmed unauthorized access to customer data around September 1, 2026.
• The leaked data includes 153 million driver's licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards, primarily from US and Canadian residents.
• Cybersecurity journalist Brian Krebs verified the data on a dark web service called 'Nexus,' which claimed to have exfiltrated records from a major ID verification vendor over a year.
• The FBI's New Orleans field office is investigating the breach, and the database has since been taken offline.
• IDScan.net is offering free credit monitoring and identity protection services to affected individuals and is notifying them of the breach.

Background

This breach follows earlier reports in early September 2026 that highlighted the risks of third-party identity verification. Previous coverage noted that IDScan.net serves major clients like Hertz, GameStop, and FedEx, and that the incident sparked class-action lawsuits alleging violations of FTC data-security guidelines. The breach underscores ongoing concerns about data minimization and the security of outsourced identity verification systems.

How outlets are covering it

Lifehacker emphasizes the immediate risk to consumers and advises checking for notifications from IDScan.net. CNET provides detailed breakdowns of the stolen data types and notes that hackers allegedly spent a year hoarding the documents before IDScan secured its systems. FEDagent focuses on the FBI's investigation into the dark web sale. All sources agree on the scale of the breach and the involvement of IDScan.net, but CNET highlights the specific clients potentially affected, while Lifehacker focuses on consumer protective steps.

Why it matters

The breach exposes a massive amount of sensitive personal data, including photos and birth dates, to identity theft. With over 150 million records compromised, the risk of synthetic identity fraud and financial crimes is significantly elevated for a large portion of the US and Canadian population.

What to watch

IDScan.net is notifying affected individuals and offering credit monitoring services. The FBI continues its investigation into the source and scope of the breach. Consumers are advised to freeze their credit, monitor financial accounts, and check their driving records for fraudulent activity.