Four Lawsuits Target IDScan.net After 153M License Breach

Key points

• Four class-action lawsuits were filed in the US District Court for the Eastern District of Louisiana against IDScan.net on Wednesday, September 3, 2026.
• The lawsuits allege that IDScan, which processes over 21 million verifications monthly for clients like Hertz and FedEx, failed to protect sensitive data as required by FTC guidelines.
• Plaintiffs from California, Florida, Georgia, and Louisiana claim their driver's license data was stolen and sold on the dark web platform Nexus.
• The FBI's New Orleans field office opened an official investigation into the breach after cybersecurity journalist Brian Krebs reported the leak.
• IDScan.net has not issued a public statement but confirmed it is investigating the matter, while the Nexus service has since gone offline.

Background

This incident follows earlier reports in early September 2026 that a dark web service named Nexus was selling digital scans of over 153 million driver's licenses from the US and Canada. Previous coverage highlighted that the data included not just standard images but also infrared and ultraviolet scans, which could be used to create counterfeit IDs that pass hologram checks. The breach was linked to IDScan.net, a third-party identity verification provider used by major corporations and government entities. The scale of the leak, which included records for high-profile individuals such as Defense Secretary Pete Hegseth, prompted immediate federal attention and raised concerns about the security of third-party ID scanning services used in car rentals and other industries.

How outlets are covering it

PCMag emphasizes the legal fallout, noting that four class-action lawsuits were filed against IDScan.net, with plaintiffs demanding damages and stronger security measures. The outlet highlights that IDScan serves major clients like Hertz, GameStop, and FedEx, and that the company has not responded to comment requests. KrebsOnSecurity provides the technical and investigative details, confirming that the FBI opened an official inquiry and that the data breach appears to have been ongoing for over a year. Krebs notes that the data includes timestamps corresponding to specific events, such as car rentals at Hertz, suggesting a real-time exfiltration of data. Ars Technica offers a personal perspective, with editor Dan Goodin reporting that his own driver's license was available for sale on Nexus within hours of renting a car, illustrating the immediacy and risk of the breach. Yahoo's coverage, while largely obscured by technical code in the provided text, aligns with the FBI's investigation and the concerns regarding commercial driver's license security. The outlets agree on the core facts of the breach and the FBI's involvement but differ in emphasis: PCMag focuses on the legal actions, Krebs on the technical evidence and FBI response, and Ars Technica on the personal impact and real-time nature of the leak.

Why it matters

The breach of 153 million driver's licenses represents a significant threat to identity security, as these documents are often used to open credit lines and verify identity. The inclusion of infrared and ultraviolet scans increases the risk of sophisticated identity theft and fraud. The legal actions against IDScan.net may set a precedent for holding third-party data processors accountable for security failures. Additionally, the FBI's investigation underscores the growing concern over the security of third-party identity verification services used by major corporations and government agencies.

What to watch

The class-action lawsuits will likely proceed through the US District Court for the Eastern District of Louisiana, with plaintiffs seeking damages and injunctive relief to force IDScan.net to implement stronger security measures. The FBI's investigation may lead to further disclosures about the scope of the breach and potential criminal charges. IDScan.net may issue a public statement or take steps to address the security concerns raised by the lawsuits and the FBI. Consumers whose data may have been affected are advised to monitor their credit, freeze their credit, and report any suspicious activity to the FTC and their state DMV.