153 million stolen licenses: IDScan confirms the data breach

IDScan admits breach: 153 million driver's licenses stolen on the dark web

IDScan has confirmed unauthorized access to 153 million scans of U.S. and Canadian driver's licenses, exposed on a dark web database. The company, specializing in identity verification for car rentals, retailers, and cannabis dispensaries, published a notice on September 4 on its website, admitting the incident occurred around September 1, 2026.

Quick Response

According to the notice, "an unauthorized third party may have accessed and/or copied customer information" stored on the company's cloud platform. The compromised data includes names and driver's license numbers or other government-issued identification documents.

The company states that it immediately launched an investigation with the help of external specialists and is collaborating with federal law enforcement. Despite access to the data being paid, IDScan chose to notify users "in an abundance of caution," offering free credit monitoring and identity protection services.

FBI investigates after discovering officials' licenses in the database

The breach emerged thanks to the investigation by security journalist Brian Krebs, who revealed how the Nexus marketplace offered access to 153 million driver's license scans, along with 10 million ID cards, 3 million travel documents, and 579,000 health cards.

Krebs verified the authenticity of the database by searching for his own data and that of other volunteers, managing to trace the exposed information back to IDScan.net. The journalist discovered that the database also included licenses of FBI officials, including the assistant director, although he did not find that of director Kash Patel.

The FBI office in New Orleans launched a formal investigation after the publication of Krebs' report. Shortly afterward, the Nexus service disappeared from the dark web, likely in response to the growing attention from authorities.

Implications for digital identity security

This breach represents one of the most serious exposures of personal identification data ever recorded. The extensive nature of the compromised dataset—which includes not only driver's licenses but also travel documents and health cards—raises significant concerns about the risk of large-scale identity theft.

Companies using identity verification services like IDScan should reevaluate their security strategies, considering the adoption of more robust solutions such as SOC as a Service or MDR services for proactive protection against these threats.

The breach also highlights the importance of adequate cyber insurance, capable of covering the costs of breach remediation and incident response in cases like this.

Legal impacts and compliance

The incident raises relevant issues for NIS2 compliance and DORA, as IDScan is an essential service provider for critical sectors such as car rentals and retail. Companies that have suffered similar breaches may face significant penalties for not adequately protecting sensitive customer data.

Additionally, the cross-border nature of the breach—with both U.S. and Canadian data exposed—poses challenges for crypto AML compliance and other privacy regulations that require rigorous protection of personal information.

Regulatory authorities are likely closely monitoring the developments of this case, which could set new precedents for managing data breaches in high-risk sectors.

Next steps for victims and companies

For the 153 million potentially affected individuals, it is crucial to carefully monitor any signs of identity theft and consider adopting Data Loss Prevention solutions to further protect their personal information.

Companies that have used IDScan's services should conduct an in-depth analysis to determine if their data has been compromised and evaluate the implementation of advanced security measures such as zero trust architecture and identity access management to prevent future breaches.

Additionally, it is essential that affected organizations consider purchasing adequate cyber risk policy to cover potential costs related to this breach, which may include regulatory penalties, legal actions from customers, and reputational damage.

The IDScan breach serves as a wake-up call for the entire digital identity verification sector. With the increase in cyber threats, it is imperative that companies adopt more robust approaches to enterprise cloud security and consider innovative solutions such as cloud security posture and CSPM to protect sensitive customer data.

This incident also underscores the importance of secure crypto asset management, as stolen identification data could be used for illicit activities in the cryptocurrency sector, making MiCA compliance crucial for platforms operating in this space.