IDScan.net Under FBI Probe After Alleged Leak of 153 Million Licenses
A massive breach of identity documents from a New Orleans verification firm exposes millions to permanent identity theft risks.
Identity verification firm IDScan.net is under federal investigation and facing multiple class-action lawsuits following an alleged massive data breach. The incident potentially exposes the personal identification of millions of citizens across North America.
The crisis emerged after a dark-web service known as "Nexus" claimed to be selling access to more than 153 million scanned driver's licenses from the United States and Canada. According to reports from cybersecurity journalist Brian Krebs and DataBreaches.Net, the leaked dataset extends beyond licenses to include over 10 million ID cards, 3 million travel documents or international IDs, and 579,000 medical cards. The breach was brought to light in September 2026 when a user on the Russian cybercrime forum "Exploit" advertised the Nexus service, using Brian Krebs' own driver's license as a sample to prove the data's authenticity.
The Scale of Exposure
IDScan.net, based in New Orleans, operates as a high-volume identity verification provider. The company provides critical security services to a roster of major corporate clients, including Target, Hertz, GameStop, and Caesars Entertainment. Because the firm specializes in detecting fraudulent documents, it maintains a vast repository of legitimate identity scans, making it a high-value target for cybercriminals.
In response to the leak, the FBI's New Orleans field office has launched a formal investigation into the incident. The scale of the alleged theft is staggering; if the figures provided by the Nexus service are accurate, this represents one of the largest identity-related breaches in history.
Permanent Identity Risk
This breach is particularly severe because of the nature of the stolen data. Unlike leaked passwords or credit card numbers, which can be reset or canceled, driver's license and government ID data are considered "permanent" identity markers. Once this information is compromised, it cannot be easily changed, leaving millions of individuals vulnerable to lifelong risks of sophisticated identity theft and fraud.
Industry experts warn that such datasets allow criminals to create highly convincing forged documents or bypass "Know Your Customer" (KYC) security checks used by banks and government agencies, effectively weaponizing the very data meant to ensure security.
Current Status
While the FBI continues its probe, the legal fallout has intensified with the filing of multiple class-action lawsuits against IDScan.net. According to PCMag, the hacker responsible for the driver's license sales appears to have shut down the Nexus site, though the data likely remains in the hands of various threat actors.
It remains to be fully confirmed exactly how the breach occurred and whether the full 153 million records were successfully exfiltrated. For now, the focus remains on the forensic investigation and the potential liability of a company entrusted with the most sensitive personal documents of millions of people.