A significant data breach at the identity verification service IDScan.net has led to the exposure of approximately 153 million personal identity documents, including driver's licenses, which are now reportedly available on a dark web marketplace. The compromised data includes front-and-back scans of driver's licenses, non-driver identification cards, travel documents, and government access cards.
The breach was brought to light by independent cybersecurity journalist Brian Krebs, who discovered the data on a Russian-language cybercrime forum and dark web marketplace named "Nexus." Krebs confirmed the legitimacy of the leaked files by locating his own driver's license scan among the compromised data.
IDScan.net, a Louisiana-based company that provides in-person identity and age verification services, confirmed the breach in a data security incident notification issued on September 4, 2026. The company stated that an unauthorized third party may have accessed and/or copied customer information stored on its cloud platform around September 1. The compromised data is believed to include full names and identification numbers from driver's licenses, primarily belonging to U.S. residents. The dataset also reportedly contains about 1.1 million Canadian IDs, 3 million travel documents, and over 579,000 medical cards. The leaked files allegedly include images of both the front and back of the identification documents, along with security features like ultraviolet and infrared markings.
IDScan.net serves numerous major corporations, including Hertz, FedEx, Target, and GameStop, as well as thousands of car rental agencies, gun shops, and cannabis dispensaries across 19 states. The company reported processing approximately 150 million ID scans in 2025 alone, highlighting the volume of sensitive data it handles.
Upon discovering the incident, IDScan.net stated it took immediate steps to secure its systems and engaged third-party specialists to investigate the full nature and scope of the breach. The company is cooperating with federal law enforcement, including the FBI, and is notifying potentially affected individuals. IDScan is offering free credit monitoring and identity protection services to those impacted.
Security experts warn that compromised driver's license information is particularly dangerous because it contains a wealth of personal data, including date of birth, home address, and physical descriptors, which can be used for extensive identity theft and impersonation. Unlike credit card numbers, driver's license numbers cannot be easily changed, leaving victims vulnerable to long-term fraud.
To mitigate the risks associated with this breach, experts advise individuals to assume their data may be compromised and to enroll in any offered identity protection services. They also recommend placing a credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion—to prevent unauthorized accounts from being opened. Continuous monitoring of financial accounts for suspicious activity and enabling two-factor authentication on sensitive online accounts are also advised. Consumers are urged to be vigilant against phishing scams, as criminals may use the stolen information to craft more convincing fraudulent communications.