FBI Investigates Alleged Breach of 170 Million ID Scans Linked to IDScan.net

A massive collection of over 170 million identity documents belonging to North Americans has been put up for sale on the dark web. The breach, which is allegedly linked to the New Orleans-based identity verification provider IDScan.net, represents one of the largest exposures of government-issued identification in history.

The data was offered for sale by a service known as Nexus on Exploit, a Russian-language cybercrime forum. According to reports, the stolen trove includes approximately 153 million driver's licenses. The FBI's New Orleans field office launched a formal investigation into the breach on September 1, 2026.

The Nature of the Theft

Unlike typical data breaches that leak text-based personal information, this incident involves high-resolution physical scans of government IDs. The exfiltrated data includes infrared and ultraviolet versions of the documents, which are typically used by verification systems to detect forgeries. Nexus claimed that the data was not stolen in a single event but was the result of continuous exfiltration over a period of more than a year.

IDScan.net provides identity verification infrastructure to a wide array of businesses. The company's client base includes rental car companies, such as Hertz, and various cannabis dispensaries, both of which require rigorous age and identity verification for legal compliance.

Industry Implications

This breach underscores the systemic risk inherent in centralized identity verification systems that store physical images of government IDs. Security experts note that while passwords can be changed after a leak, government IDs are "enduring" credentials. Once a high-resolution scan—complete with security features—is compromised, it can be used for long-term identity theft or the creation of sophisticated synthetic identities that can bypass traditional security checks.

The scale of the Nexus leak is expected to accelerate the industry shift toward privacy-preserving digital identity models. This includes the adoption of mobile driver's licenses (mDL), which allow users to share only the necessary data points (such as "over 21") without transmitting or storing a full image of the physical document.

What Remains Unconfirmed

While the FBI investigation is active, the full scope of the breach remains under scrutiny. While the total number of documents is estimated at over 170 million, the exact breakdown of non-license documents—including travel and medical cards—has not been independently verified. It remains to be seen whether IDScan.net will formally acknowledge the breach or if the investigation will uncover other points of origin for the exfiltrated data.