FBI Probes IDScan.net After 153 Million Driver's License Scans Leak
A massive breach of high-resolution government IDs has triggered a federal investigation and multiple class-action lawsuits.
The FBI's New Orleans field office launched a formal investigation into identity verification firm IDScan.net on September 1, 2026, after millions of government-issued IDs appeared on the dark web. The breach exposes a critical vulnerability in how third-party vendors handle permanent biometric and personal data.
Federal investigators opened their probe following the emergence of a dark web service known as "Nexus." According to journalist Brian Krebs, who first brought the leak to light, Nexus offered searchable access to more than 153 million driver's license scans from the United States and Canada. The stolen data is not limited to standard photos; the breach includes high-resolution images as well as infrared (IR) and ultraviolet (UV) scans. Beyond driver's licenses, the Nexus database reportedly contains 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
The Supply Chain Vulnerability
IDScan.net, based in New Orleans, provides automated compliance and fraud prevention services for a wide array of businesses, including retail outlets and car rental agencies. The company's role as a middleman creates a "supply chain" risk, where sensitive data is stored by a vendor without the explicit awareness or direct consent of the end consumer.
Brian Krebs discovered the breach after finding his own driver's license within the database. He noted that the timestamps associated with the scans correlated specifically to transactions made at Hertz car rental locations, illustrating how routine commercial interactions can lead to the permanent storage of sensitive government documents in vulnerable third-party databases.
Permanent Identity Risk
This incident is particularly severe because, unlike passwords or credit card numbers, driver's license data and biometric images cannot be reset. The exposure of high-resolution and UV/IR scans provides bad actors with the raw materials needed to create highly convincing forged documents, creating a lifelong risk of identity theft for the millions of affected individuals.
As a result of these security failures, IDScan.net is now facing multiple class-action lawsuits. The legal filings allege that the company failed to implement industry-standard security measures to protect the massive volume of sensitive data it processed on behalf of its clients.
What's Next
While the FBI investigation is ongoing, the full extent of the breach's impact remains to be seen. Industry analysts are watching to see if other identity verification vendors are utilizing similar storage practices that could lead to further exposures. For now, the focus remains on the legal fallout and the federal effort to determine how the Nexus service obtained such a comprehensive archive of North American identification.