A Dark-Web Site Claimed to Have 153 Million Driver’s License Scans, Then IDScan Confirmed a Breach That Still Leaves One Huge Question Unanswered
A data security story took a disturbing turn after a dark-web marketplace began advertising access to millions of American and Canadian identity documents, including driver’s licenses. A New York Post report published September 11, 2026 highlighted the alarming figure of 153 million licenses allegedly available through an identity-theft service. The number captured the scale of the reported exposure, but an important distinction remains between what criminals claimed to possess and what investigators or the company have officially confirmed.
The company drawn into the controversy was IDScan.net, an identity verification provider whose technology helps businesses scan and examine government-issued identification. Reports connected the company’s systems to records advertised through a service known as Nexus, prompting questions about how sensitive documents collected during ordinary transactions could end up in criminal hands. IDScan subsequently acknowledged unauthorized access to part of its cloud environment, although its public disclosures have not established that every record advertised by Nexus came from its systems.
It Began With a Free Sample
The investigation became public on September 1, when cybersecurity journalist Brian Krebs reported discovering a dark-web service selling access to a massive collection of identity documents. According to his original investigation published by KrebsOnSecurity, a source had alerted him to an advertisement posted on a Russian-language cybercrime forum on August 31. The seller had included Krebs’s own Virginia driver’s license as a sample, giving him a concrete reason to investigate whether the advertised database contained genuine information.
The marketplace, which called itself Nexus, claimed to hold identity records covering more than 170 million people across North America. Its advertised inventory included driver’s licenses, other identification cards, travel documents and medical cards, creating concerns that extended beyond a single type of government document. The appearance of Krebs’s license in the collection provided an initial lead, but determining how the records had been obtained required further examination.
The Marketplace’s Totals Were Claims, Not a Confirmed Victim Count
Nexus advertised more than 153 million driver’s licenses belonging to people in the United States and Canada, alongside more than 10 million other identification cards. The service also claimed to hold more than three million travel documents or international identification records and at least 579,000 medical cards. These figures described the marketplace’s advertised inventory, not an independently verified count of unique individuals affected by the IDScan incident.
Krebs examined the site’s search results and found approximately 11.5 million pages, with roughly 15 records displayed on each page, lending some support to the apparent scale of the collection. He also observed that the seller’s advertised driver’s license total had increased by nearly 400,000 records over a 24-hour period. Those observations raised concerns that the inventory was growing, but they could not establish how many distinct people were represented, whether every listing was genuine, or whether the entire collection originated from one breach.
The Records Appeared to Contain Real Identity Documents
The journalist went beyond examining the marketplace’s claims by comparing records with information supplied by people who agreed to participate in his research. Some individuals found their own driver’s licenses in the collection, giving investigators and researchers concrete examples to examine rather than relying entirely on a criminal seller’s description. The matching records also contained timestamps that could help establish when the documents had been scanned.
Some listings contained multiple images of the same license, including photographs of its front and back and additional scans in different formats. Krebs found that the timestamps associated with his record corresponded to a trip he had taken in June 2025, when he traveled within the United States. The matching date gave the investigation a useful lead, although a timestamp alone could not conclusively identify the organization or device responsible for collecting a particular document.
Timestamps Pointed Toward Familiar Places Where People Show IDs
As researchers compared records with their owners’ recollections, ordinary transactions emerged as an important clue. Krebs reported that two people whose licenses appeared in the marketplace had rented vehicles from Hertz on the dates associated with their records. In another example, cybersecurity researcher Zach Edwards found his own license listed for sale, with a timestamp corresponding to a trip to Las Vegas.
Edwards said he had presented his license at several locations during that trip, including an airport security checkpoint, a hotel and a marijuana dispensary, but identified the dispensary as the place where he was certain his identification had been scanned. That dispensary was Planet 13, a business whose identity verification arrangements provided another lead for examining the potential source of the records. These examples helped researchers build a plausible connection between the marketplace’s inventory and commercial identity-scanning systems, but they did not independently prove which transaction or company account was responsible for every exposed document.
Why IDScan.net Became the Focus
IDScan.net, a company based in the New Orleans area, provides technology that businesses use to scan and verify government-issued identification. Its products serve multiple industries, including hospitality, retail, banking, cannabis businesses and equipment rental operations, where checking a customer’s identity may be part of an ordinary transaction. Because the technology processes identification documents at the point where customers present them, a compromise involving its systems could potentially affect records originating from many separate businesses.
Researchers found additional links between IDScan and the transactions they were investigating. The company’s published materials identified major business relationships, including Hertz, while a 2022 announcement described an identity verification agreement with Planet 13. Those connections strengthened the case for investigating IDScan as a possible source of the marketplace’s data, although neither the business relationships nor the matching timestamps established that every record offered by Nexus had been taken from the company’s systems.
IDScan Acknowledged Unauthorized Access Days Later
On September 4, IDScan.net published a notice acknowledging that certain information might have been accessed without authorization. The company said it had received information about the possible incident around September 1, taken steps to secure its systems and engaged outside specialists to investigate. Its initial notice explained that an unauthorized third party might have accessed or copied customer information stored in the company’s cloud environment.
The statement established that the company was investigating a genuine security incident, rather than leaving the entire story dependent on the claims of a dark-web seller. IDScan identified potentially involved information as including full names and driver’s license or other government-issued identification numbers. However, the notice did not provide a confirmed total number of affected individuals or establish that the company’s incident accounted for the marketplace’s entire advertised collection.
The Investigation Later Narrowed the Technical Scope
IDScan’s official data security incident notice, updated September 29, provided a more specific account of the incident as the investigation progressed. The company said an unauthorized third party had gained access to part of its cloud environment between April 4 and September 2, 2026. It also said the event had been limited to its VeriScan platform, with no other IDScan products or services identified as involved.
That timeframe matters because it distinguishes the period of access identified by the company’s investigation from the much broader duration claimed by the operators of Nexus. The marketplace’s operators had asserted that they had been extracting new information for more than a year, but IDScan’s public findings did not independently establish that claim. As of the company’s latest detailed disclosure, its investigation remained ongoing, and the full relationship between the confirmed access and the marketplace’s advertised inventory had not been publicly resolved.
The Information at Risk Could Extend Beyond License Numbers
The company’s updated notice described a wider range of information that might have been involved, depending on what individual customer organizations collected or stored. Potential categories included full names, contact information, dates of birth, driver’s license numbers, passport information and other government-issued identification numbers. IDScan cautioned that not every category necessarily applied to every person whose information may have been affected.
That distinction is important because identity verification systems can handle different kinds of information depending on a business’s needs. A particular transaction might involve a license number and name, while another could involve a broader set of identifying details. The company has not publicly established that all potentially affected records contained every category listed in its notice, so the precise information at risk may differ among individuals.
Federal Investigators Had Already Started Looking
The FBI’s involvement was reported at the beginning of the public investigation, before IDScan issued its September 4 notice. In a September 2 report, Reuters reported that the FBI was investigating claims that millions of US and Canadian driver’s licenses were being sold on the dark web. The bureau confirmed that it was looking into the incident but declined to discuss details because the investigation was ongoing.
The initial inquiry focused on identifying the source of the records and examining the claims surrounding the marketplace. Krebs’s reporting and the FBI’s confirmation helped bring the issue to wider attention, but an investigation does not by itself establish who carried out an intrusion or exactly what information was taken. The public information reviewed here does not establish a final investigative conclusion attributing the entire Nexus collection to a particular actor or intrusion.
Canada’s Privacy Commissioner Opened a Separate Inquiry
The possible exposure also prompted action in Canada, where the records reportedly included information belonging to Canadian residents. On September 21, the Office of the Privacy Commissioner of Canada announced an investigation into IDScan.net. The office said it would examine the company’s security safeguards and the adequacy of its notifications to affected individuals under Canada’s federal private-sector privacy law.
The Canadian investigation adds a regulatory dimension to a case that initially centered on a criminal marketplace and the possible source of its records. The commissioner said the office was engaging with IDScan to address risks to Canadians and determine whether the company’s practices complied with applicable privacy requirements. Because that inquiry was still active, the regulator did not publish a final determination about the company’s compliance or establish a confirmed number of affected Canadian residents.
Nexus Disappeared, but That Did Not Resolve the Exposure
Shortly after Krebs published his initial findings on September 1, the Nexus website disappeared from the dark web. Its login page was replaced with a message stating that the service was no longer available, cutting off the public-facing marketplace described in the investigation. The sudden disappearance did not explain why the service had shut down or establish what happened to the records it had advertised.
Taking a marketplace offline is also different from confirming that its data has been deleted or that no copies remain elsewhere. The public reporting reviewed here does not establish whether all copies of the advertised documents were removed, retained by the operators or redistributed to other parties. That uncertainty leaves an important gap between the disappearance of the service and the broader question of whether the underlying information remains accessible to criminals.
Why Driver’s License Images Are Particularly Sensitive
A driver’s license is more than a number printed on a plastic card. Depending on the fields captured, its digital record can combine a person’s name, date of birth, address, license number and photograph in a single collection of information that can be useful for impersonation attempts. When a scan includes both sides of a document or several additional image formats, the exposed material may provide more information than a simple text entry.
Security researchers cited in the initial reporting warned that identity documents can be misused in financial fraud and other forms of impersonation. Unlike a password, a person’s face, date of birth or historical address cannot necessarily be changed easily after exposure. That does not mean every person whose document appears in an exposed collection will experience fraud, but it explains why investigators and privacy regulators treat the possible loss of identification records seriously.
IDScan Says It Has No Evidence of Misuse
In its latest public update available before October 21, IDScan continued to describe the incident as an ongoing investigation. An October 16 update distributed by IDScan.net repeated that unauthorized access had affected part of the company’s cloud environment between April 4 and September 2 and had been limited to the VeriScan platform. The company also said it was cooperating with law enforcement and reviewing additional security enhancements.
IDScan stated that it was not aware of misuse of personal information resulting from the incident. That statement describes what the company knew at the time of its update and should not be taken as proof that no information was copied, retained or misused without detection. The same update reiterated that potentially affected individuals could access free credit monitoring and identity protection services.
People Concerned About Exposure Have Practical Options
IDScan has encouraged potentially affected individuals to monitor account statements, watch for suspicious activity and use the protection services the company is offering. The company’s incident notice lists a toll-free number, 1-833-516-2980, for questions about the incident and enrollment in those services, with representatives available Monday through Friday from 8 a.m. to 8 p.m. Eastern Time, excluding holidays. People who receive a notice should review which information it says may have been involved rather than assume that every category applies to them.
The Federal Trade Commission also recommends checking credit reports and considering a fraud alert or credit freeze when personal information may have been exposed. Its guide to credit freezes and fraud alerts explains that freezes are free and can make it harder for someone to open new credit accounts in another person’s name. Anyone who discovers suspected identity theft can also use the federal government’s IdentityTheft.gov resource to report the problem and obtain recovery guidance.
The Most Important Number Is Still Missing
The central question is no longer simply whether IDScan experienced unauthorized access, because the company has acknowledged that part of its cloud environment was accessed. What remains unresolved publicly is how many people were affected by the confirmed incident, how much information was copied and exactly how the company’s findings relate to the records advertised by Nexus. The marketplace’s figure of 153 million driver’s licenses continues to describe its claimed inventory, not an official count of verified victims.
That distinction matters for customers, businesses and regulators trying to understand the incident’s true scale. IDScan has identified the VeriScan platform as the affected service and described the information that may have been involved, but its investigation has not supplied a final public accounting of affected individuals. Until further findings establish the scope and origin of the advertised records, the breach remains a serious warning about the risks of storing sensitive identity documents, with its full human impact still uncertain.
