Reported by 10 outlets
IDScan Data Breach Exposes 153 Million Driver's Licenses
Why this score
- Breadth
- 2.00 / 2.0 · 10 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.20 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
This is not a software vulnerability with a patch, it is the theft of an identity verification vendor's archive while it was still growing. IDScan.net, the New Orleans company whose scanners read licenses at rental counters, dispensaries, hotels, banks and gun shops, confirmed in a September 4 notice that an unauthorized third party may have copied customer data from accounts on the IDScan.net cloud, naming full names and driver's license or government ID numbers. The exposure surfaced on August 31, when a service calling itself Nexus opened for business on the Exploit forum selling scans of more than 153 million US and Canadian driver's licenses, 10 million ID cards, 3 million travel documents and 579,000 medical cards, and KrebsOnSecurity traced records to IDScan through scan timestamps. Two numbers frame the damage: IDScan's follow-up reporting puts confirmed stolen licenses at 13 to 15 million, while the Nexus catalog advertised 153 million and was still adding about 400,000 records per day when first examined.
The mechanism matters more than the count. These are not database rows but authenticated document images: Nexus records carry six image files per license, including infrared and ultraviolet captures taken precisely to prove a document is genuine, which Ars Technica noted could let a clone pass hologram checks. Unlike passwords, identity documents cannot be rotated; a full name, license number and front-and-back images survive every credential reset and are enough to beat many onboarding and account-recovery checks. The blast radius is effectively anyone who has handed an ID to a scanning counter, since IDScan claims over 21 million verifications monthly at more than 20,000 locations, and Krebs matched victims' records to Hertz rentals and Planet13 dispensary visits down to the same seconds. Nexus went dark within hours of exposure, but that only closed the storefront; BleepingComputer reports multiple actors claiming to resell the same corpus, so takedown is not remediation.
There is nothing to patch, so the work is hygiene and hunting. Organizations that are IDScan or VeriScan customers should audit IDScan.net cloud tenant access logs for unauthorized reads back through August 2025, since the sellers claimed over a year of continuous exfiltration, and rotate tenant credentials and API keys. Onboarding and KYC teams should stop treating a clean license image as proof of identity and add face match, liveness and out-of-band checks for accounts opened with US or Canadian license data. If a resale dump surfaces, it is fingerprintable: six-image sets with GMT-timestamped filenames and source tags such as CDL and CAC mark this corpus. Individuals can use IDScan's free credit monitoring and identity protection offer, hotline 1-833-516-2980, or place their own credit freezes, and businesses whose counters fed scans into IDScan should assume their customers' images are included and prepare their own notification obligations.
Two developments would change the assessment. A verified resale of the full 153 million catalog, or a revision of the confirmed 13 to 15 million figure upward, would turn a serious vendor breach into standing input for identity fraud at national scale. The FBI's New Orleans investigation and the Louisiana lawsuits will also settle whether retention was authorized at all: the notice says full access to the exposed information required payment, while Caesars has said it stopped using VeriScan in February 2025 and never authorized IDScan to keep its data, and the answer determines how much of this corpus should never have existed.
Timeline
-
original reporting
Well, who could've have predicted _that_ I wonder? Imagine my complete lack of surprise in discovering that the millions of identity documen
www.bleepingcomputer.com · 33d ago · September 10th, 2026
Well, who could've have predicted that I wonder? Imagine my complete lack of surprise in discovering that the millions of identity documen
via Mastodon https://www.bleepingcomputer.com/news/security/idscan-confirms-breach-tied-to-153-million-stolen-drivers-licenses/
-
update from krebsonsecurity.com
FBI Probes Service Selling 153M+ Drivers Licenses
krebsonsecurity.com · 42d ago · September 1st, 2026
Original disclosure: on August 31 a new identity theft service called Nexus advertised on the Exploit forum access to scans of more than 153 million US and Canadian driver's licenses, plus 10 million ID cards, 3 million travel documents and 579,000 medical cards. Krebs verified records via consenting victims, matched scan timestamps (in GMT) to Hertz rentals and Planet13 dispensary visits, and observed roughly 400,000 records added in 24 hours, with sellers claiming over a year of continuous exfiltration. The FBI's New Orleans field office opened an official investigation into idscan.net the same day; Nexus went dark hours after publication.
-
update from arstechnica.com
I rented a car, and within hours, my driver's license was for sale
arstechnica.com · 41d ago · September 2nd, 2026
Dan Goodin's first-person account: a high-resolution scan of his license appeared on Nexus within hours of an employee scanning it at a car rental counter, implying near real-time access to the scanning vendor's data. Each record carried six image files including infrared and ultraviolet captures, which could let cloned counterfeit IDs pass hologram tests. Nexus went dark within hours of the KrebsOnSecurity scoop, removing the only way for people to check whether their IDs were included.
-
update from idscan.net
Notification of Data Security Incident
idscan.net · 40d ago · September 4th, 2026
The vendor advisory, dated September 4, 2026: IDScan.net learned on or around September 1 that certain data may have been accessed without authorization and determined an unauthorized third party may have accessed or copied customer information stored within accounts on the IDScan.net cloud, including full names and driver's license or other government-issued identification numbers. The notice states full access to the information required payment, offers free credit monitoring and identity protection (hotline 1-833-516-2980), and says the company is cooperating with federal law enforcement. TechCrunch reported the page was published with a noindex directive keeping it out of search engines.
-
update from bleepingcomputer.com
IDScan sued over alleged data breach affecting 153 million drivers
bleepingcomputer.com · 39d ago · September 4th, 2026
First news of legal fallout: multiple lawsuits filed in Louisiana against IDScan, with law firms including Markovits, Stock & DeMarco and Hall Attorneys investigating class actions, alleging IDScan failed to protect client data such as Hertz's. Reuters independently confirmed the FBI investigation, and BleepingComputer reported records belonging to Defense Secretary Pete Hegseth and an FBI assistant director appeared in the service. IDScan had made no public statement at that point, though the firm says business customers were notified around September 1.
-
mentioned by schneier.com
Driver’s License Data for Sale
schneier.com · 34d ago · September 9th, 2026
-
update from bleepingcomputer.com
IDScan confirms breach tied to 153 million stolen driver’s licenses
bleepingcomputer.com · 33d ago · September 10th, 2026
Identity verification company IDScan has confirmed that hackers accessed customer data stored in its cloud platform, days after reports linked the company to a massive database containing more than 153 million driver's license scans. "Upon this discovery, we took immediate steps to secure our systems and engaged a team of third-party specialists to help determine the full nature and scope of the incident," IDScan said . While not mentioned in the notification, the breach reportedly also allowed threat actors to steal scans of driver's licenses.
-
mentioned by techcrunch.com
ID verification giant IDScan confirms data breach with more than 150 million driver’s licenses stolen The ID checking company said the data
techcrunch.com · 33d ago · September 10th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 IDScan confirms a breach tied to a database of 153 million driver's license scans. Hackers accessed its IDScan.net cloud; customer data ma
www.bleepingcomputer.com · 33d ago · September 11th, 2026
-
mentioned by thecybersecguru.com
🚨 IDScan.net has CONFIRMED a massive data breach. More than 153 MILLION U.S. & Canadian driver’s licenses are reportedly tied to the inciden
thecybersecguru.com · 32d ago · September 11th, 2026
-
mentioned by techcrunch.com
ID verification giant # IDScan confirms # DataBreach with more than 150 million driver’s licenses stolen https:// techcrunch.com/2026/09/10/
techcrunch.com · 31d ago · September 12th, 2026
-
update from therecord.media
https:// therecord.media/idscan-data-br each-notice-drivers-licenses # DataBreach # CyberSecurity # IdentityTheft # IDScan # DriverLicenses
therecord.media · 28d ago · September 15th, 2026
https:// therecord.media/idscan-data-br each-notice-drivers-licenses # DataBreach # CyberSecurity # IdentityTheft # IDScan # DriverLicenses
via Mastodon https://therecord.media/idscan-data-breach-notice-drivers-licenses
-
mentioned by this.weekinsecurity.com
"Identity verification giant IDScan has confirmed that hackers stole at least 13 to 15 million driver's licenses during a cyberattack and da
this.weekinsecurity.com · 24d ago · September 19th, 2026
-
mentioned by justpaste.in
ID verification giant IDScan confirms data breach with more than 150 million driver’s licenses stolen The ID checking company said the data
justpaste.in · 14d ago · September 29th, 2026