FBI Investigates Breach Exposing 153 Million Driver’s Licenses via ID Verification Vendor

Key points

• The dark web service Nexus claims to hold over 153 million driver’s license scans, along with 10 million other ID cards and 3 million travel documents.
• The FBI’s New Orleans field office has launched an official investigation into the apparent breach at IDScan.net, a Louisiana-based identity verification company.
• IDScan.net processes over 21 million identity verifications monthly for clients including Hertz, Target, and Planet13, and has not yet confirmed the breach.
• The leaked data includes multiple image formats, such as infrared and ultraviolet scans, which could facilitate the creation of counterfeit IDs.
• Security experts argue that the incident highlights the risks of outsourcing identity verification to third-party vendors and the need for data minimization and zero-knowledge proofs.

Background

This incident follows a series of high-profile data breaches in 2024 and 2025, including the AT&T breach affecting 73 million customers and the PowerSchool breach exposing student and teacher data. It also occurs amid growing discussions about the adoption of digital driver’s licenses, such as Virginia’s recent integration with Apple Wallet, which aims to reduce the need for physical ID scans.

How outlets are covering it

KrebsOnSecurity and Ars Technica emphasize the scale and immediacy of the breach, with Krebs noting that the data grew by nearly 400,000 records in 24 hours, suggesting ongoing exfiltration. Ars Technica highlights the personal impact, with its author finding their own license for sale within hours of renting a car. WGAL focuses on consumer advice, urging individuals to freeze their credit. Coin Center’s Peter Van Valkenburgh argues that the breach is inevitable due to the current KYC infrastructure, advocating for data minimization and zero-knowledge proofs. IDScan.net has not publicly confirmed the breach but is investigating, while the FBI has opened an inquiry.

Why it matters

The breach exposes the vulnerabilities in the current identity verification system, where third-party vendors collect and store sensitive personal data. The availability of high-resolution scans, including infrared and ultraviolet images, increases the risk of identity theft and the creation of counterfeit IDs. The incident underscores the need for stronger security measures, regulatory changes, and the adoption of technologies that minimize data collection, such as zero-knowledge proofs, to protect consumers from future breaches.

What to watch

The FBI’s investigation into the breach at IDScan.net is expected to continue, with potential legal and regulatory consequences for the company. IDScan.net may face scrutiny over its security practices and data handling procedures. Consumers are advised to monitor their credit and consider freezing their credit to prevent identity theft. The incident may also prompt broader discussions about the need for data minimization and the adoption of zero-knowledge proofs in identity verification systems.