IDScan Breach Exposes 153 Million Identity Documents

Identity verification service IDScan has suffered a catastrophic data breach exposing approximately 153 million personal identity documents. The leak provides cybercriminals with high-resolution imagery of government IDs, creating a long-term security crisis for millions of users across North America.

The breach includes roughly 153 million driver's licenses, 10 million ID cards, 3 million travel documents, and approximately 579,000 medical cards. The stolen data is not limited to basic text; it includes high-resolution scans of both the front and back of licenses. Most critically, the exfiltrated data contains ultraviolet (UV) and infrared (IR) images—specialized captures used by verification systems to detect forgeries—which could allow bad actors to create highly convincing fake credentials.

The Discovery

Cybersecurity journalist Brian Krebs brought the security failure to light after the stolen data appeared for sale on 'Nexus,' a Russian-language dark web marketplace. IDScan officially acknowledged the breach on September 4, 2026, stating that the company detected unauthorized access to its systems around September 1.

While the vast majority of the affected individuals are U.S. residents, the breach also compromised the personal information of approximately 1.1 million Canadians. The scale of the leak aligns with the company's operational volume; in 2025, the Louisiana-based firm reported processing 150 million ID scans for its clients.

Permanent Identity Risk

Security experts warn that this breach is fundamentally different from a typical credit card leak. While a compromised credit card can be canceled and replaced within minutes, driver's license numbers and physical descriptors are largely permanent.

Because the hackers now possess the exact visual and technical markers used to verify identity, victims face a lifelong risk of impersonation. These high-fidelity scans can be used to open fraudulent bank accounts, apply for loans, or bypass security checks at financial institutions. As noted via the New York Post, a compromised driver’s license is significantly more dangerous than a stolen credit card because the data cannot be simply reset.

What's Next

Victims are encouraged to monitor their credit reports for unauthorized accounts and consider freezing their credit to prevent new lines of credit from being opened in their names. It remains unclear exactly how the attackers gained access to the cloud platform or how long the vulnerability existed before detection. Industry analysts are now watching to see if other identity verification providers face similar exploits, as the success of the Nexus marketplace listing proves the high market value of verified government imagery.