A dark web service called "Nexus" has reportedly been selling access to more than 153 million U.S. and Canadian driver's license scans. The material has been linked to IDScan.net, a Louisiana-based identity verification vendor whose software is used by bars, casinos, car rental firms, retailers, entertainment venues and cannabis dispensaries. IDScan.net has confirmed that an unauthorized third party got into part of its cloud environment between April 4 and September 2, 2026. It has not publicly confirmed the 153 million figure or that Nexus's inventory came from its systems. That figure comes from the seller's listing, as reported by Brian Krebs. The size of the breach should therefore be treated as alleged. Estimates differ widely: a Texas breach filing reported by eSecurityPlanet lists 13 million people affected, the FBI was quoted as describing "tens of millions" of licenses (CBC), and the dark web listing claims 153 million records. Canada's privacy commissioner, the FBI and the Pentagon are all looking into the incident.
What Happened
According to Help Net Security and Barracuda, a source told security journalist Brian Krebs on August 31, 2026 about a listing for Nexus on a Russian-language cybercrime forum. Krebs reported on September 1 that the service let buyers search driver's license records, including photos, for people in the United States and Canada. TechCrunch says Krebs checked that the data was real by finding his own record. Outlets report that the database also held records for high-profile people. TechCrunch names U.S. Secretary of Defense Pete Hegseth and a security researcher who confirmed their own record. Barracuda adds an FBI assistant director.
IDScan.net says it "received information" on or around September 1 suggesting data may have been accessed without authorization. It published a security notice on September 4. TechCrunch and BleepingComputer both found that the page carried a noindex directive, which tells search engines not to list it. BleepingComputer reports that by then several lawsuits had already been filed against the company, and IDScan.net had not answered press questions. Partner notification began quickly: Harborside, a cannabis retailer, says IDScan.net informed it on September 4.
In an update on September 30, reported by PCMag, the company said the intruder had access to "a portion of our cloud environment" from April 4 to September 2, 2026. It also said the compromise was limited to its VeriScan platform. Harborside's customer notice repeats both points. The reported duration does not fully match. TechCrunch described the incident as a "year-long hack" based on early reporting, while the company's own update gives about five months. PCMag reports that the seller later shut down the Nexus site, but the data could still be sold through private channels.
Several authorities are now involved. CBC reports that the FBI confirmed it was "looking into the incident" two days before IDScan.net's notice. The Pentagon told TechCrunch it was aware of the suspected breach. Canada's privacy commissioner opened a formal investigation in September (CBC). IDScan.net says it is cooperating with federal law enforcement and regulators.
What Was Taken
Volume (accounts differ): - 153 million+ driver's licenses: the figure from the Nexus listing as reported by Krebs, BleepingComputer, TechCrunch and Help Net Security. Help Net Security, citing Krebs, says the listing also advertised 10 million ID cards, 3 million travel documents and 579,000 medical cards. - 13 million people: a Texas breach listing dated September 21, reported by eSecurityPlanet. That listing shows only one affected Texas resident. eSecurityPlanet notes that the two numbers measure different things: 153 million is the criminals' count of records, and 13 million is the count of people reported to a regulator. They should not be treated as the same thing. - "Tens of millions": how CBC described the reported theft when covering the FBI's statement.
IDScan.net has not published an overall count. PCMag notes that the exact number of affected people is still unknown.
Data types: - Company notice (via BleepingComputer, TechCrunch, Help Net Security): full names and driver's license or other government ID numbers. TechCrunch says this includes passport numbers. - Company update (via PCMag): full names, contact details, dates of birth, driver's licenses, passports and government ID numbers. The company says the categories "may vary" depending on how each customer set up VeriScan. - Harborside notice (one customer's view): name, home address, date of birth, sex, license number, issuing state, issue and expiry dates, and document control number. It also lists an image of the front of the ID showing photo, signature and physical descriptors, plus scan metadata: timestamp, store, the scanning device's approximate GPS coordinates and the result of the authenticity check. Harborside says it has no indication that passports, medical cards, phone numbers, email addresses, Social Security numbers or payment data were involved for its customers. - Seller's claim (via Barracuda, citing Krebs): front and back images plus infrared and ultraviolet scans. IDScan.net has not confirmed this, and the Harborside notice mentions only front images.
BleepingComputer notes that IDScan.net's first notice did not mention license scans at all, even though the theft of scans was reported elsewhere. The company says "full access to the information required payment," apparently referring to the Nexus paywall. It is offering affected people in the U.S. and Canada free credit monitoring and identity protection.
Why It Matters
Infoblox researcher Zach Edwards told Reuters (as quoted by CBC): "There's never been a breach of driver's licences at this scale." Even at the lower end of the estimates, this is one of the largest exposures of government ID documents in North America.
Barracuda's analysis points to four reasons defenders should care:
- Forgery at forensic detail. If the infrared and ultraviolet scans are real, forgers could make cards that pass both visual and machine checks, possibly including REAL ID credentials.
- KYC and account-opening fraud. Clean license images with matching personal data are exactly what many identity verification and selfie-plus-ID workflows check against. They are useful for opening accounts, applying for benefits and resetting passwords through help desks.
- Physical access and targeting. Barracuda says the listing also included access cards for secure facilities. The scan metadata described by Harborside ties a named person to a location and time. The presence of senior defense and law enforcement officials makes this a counterintelligence concern as well as a fraud problem.
- Third-party concentration risk. Thousands of businesses each scanned IDs at the door and sent them to one vendor's cloud. A business's own systems can be clean (Harborside says its systems were not involved) while its customers' IDs are exposed through the vendor.
The Attack Technique
The initial access method has not been disclosed. What is known so far:
- The intruder had access to "a portion" of IDScan.net's cloud environment for about five months (April 4 to September 2, 2026), according to the company's update reported by PCMag. Early reporting cited by TechCrunch suggested roughly a year.
- The company says the compromise was limited to the VeriScan platform and did not affect other IDScan.net products.
- The data was sold as a searchable, pay-per-access service (Nexus) advertised on a Russian-language forum, not as a one-off dump.
- IDScan.net found out from an outside report, not from its own detection, and only after months of access.
No source names a threat actor, vulnerability or credential compromise. Readers should treat claims about the attack vector with caution until IDScan.net or investigators publish findings.
What Organizations Should Do
- Check your exposure to ID verification vendors. Find every vendor that captures, stores or processes customer or employee ID scans, including VeriScan deployments. Confirm whether data is kept after verification, for how long, and where.
- Cut retention to the minimum. Configure scanning tools to verify and then discard data, or keep only the fields you need. As IDScan.net notes, what was exposed depended on what each customer chose to collect and store. Turn off image capture and GPS logging if you don't need them.
- Don't let a license image count as strong proof of identity. Expect high-quality copies of real licenses to be in circulation. Add liveness checks, phishing-resistant MFA, out-of-band confirmation for help desk resets and payout changes, and checks against known breach data for new account onboarding.
- Tighten physical access controls. Reissue or re-check access badges where facility credentials may be involved. Train front-desk and security staff to expect convincing forged IDs and to require a second factor for entry to sensitive areas.
- Prepare for impersonation and phishing. Warn staff and customers, especially executives and anyone in government or defense roles, about pretexting campaigns that use real license details. Breach-themed phishing that offers "credit monitoring" or "claim your settlement" usually follows incidents like this.
- Strengthen vendor contracts and monitoring. Require breach notice deadlines, logging and audit rights, and encryption of stored ID images. Keep in mind that this vendor's notice was hidden from search engines and came only after outside reporting. Watch the dark web and the press for your vendors' names; don't count on being told.
Sources: IDScan.net Data Breach: What to Do Next - Barracuda Blog | IDScan confirms breach tied to 153 million stolen driver’s licenses | ID verification giant IDScan confirms data breach with more than 15... | Canadian investigation launched into data breach that exposed milli... | IDScan confirms breach after 153 million driver’s licenses leak on... | Company Behind Leak of Driver's Licenses Says Hacker Had Access for... | NOTICE OF DATA BREACH | IDScan Breach Filing: 13M People Affected After 153M-Record Dark We...