IDScan Breach Exposes 153 Million US and Canadian Identity Documents

Identity verification platform IDScan.net has confirmed a massive data breach that exposed millions of government-issued identity documents from the United States and Canada. The leak represents a critical security failure for a firm trusted by corporate entities to prevent fraud and ensure compliance.

An unauthorized third party accessed IDScan's cloud storage, stealing full names, driver's license numbers, passports, and other government-issued ID numbers. The scale of the exposure became public after a dark web marketplace known as "Nexus" began selling scans of more than 153 million driver's licenses linked to the platform. In response, the Louisiana-based firm is offering free credit monitoring and identity protection services to those affected.

The Scope of the Intrusion

IDScan.net provides AI-driven identity verification services to a wide array of corporate clients, including cannabis dispensaries and entertainment venues. The breach came to light after the Nexus marketplace emerged as a hub where users could search for photos and personal information from the leaked IDs. IDScan officially confirmed the intrusion, stating that an unauthorized party accessed or copied customer information stored within their cloud accounts.

National Security Implications

The breach has escalated beyond a corporate data leak into a federal security matter. The FBI and the Pentagon have launched investigations after it was discovered that high-profile individuals were included in the stolen data. Specifically, the leaked documents contained the identity information of U.S. Secretary of Defense Pete Hegseth, highlighting the vulnerability of even the highest-ranking government officials when their data is processed by third-party verification vendors.

Industry Consequences

This incident is particularly severe because it involves raw scans of government IDs rather than just text-based data. Such documents are high-value targets for cybercriminals, as they provide the necessary components for sophisticated identity theft and the creation of synthetic identities. For the identity verification industry, the breach underscores the systemic risk of centralizing millions of sensitive government documents in cloud environments that can become single points of failure.

Next Steps

IDScan continues to cooperate with federal law enforcement as the investigation into the source and extent of the breach proceeds. While the company has begun notifying affected users, the full impact of the 153 million exposed records remains to be seen as the data continues to circulate on the dark web.