IDScan Breach: 153 Million Driver's Licenses Exposed

A new dark web identity theft service called Nexus reportedly offered digital scans of more than 153 million driver's licenses from the United States and Canada.

The same service claimed to hold more than 10 million additional ID cards, 3 million travel documents, and 579,000 medical cards.

The FBI's New Orleans field office has opened an investigation into an apparent breach involving IDScan.net, a Louisiana-based identity verification provider.

This is breaking news. The investigation is active. The full scope is not confirmed.

But you do not need to wait for a final report before protecting yourself.

What happened?

According to KrebsOnSecurity, Nexus began selling access to high-quality scans of identity documents in late August or early September 2026.

The records reportedly included:

Front and back images of driver's licenses
License photographs and personal information
Barcodes and machine-readable data
Infrared and ultraviolet scans
Timestamps connected to when the ID was scanned
Additional government, travel, medical, and dispensary identification cards

KrebsOnSecurity traced timestamps from several leaked licenses to real-world transactions. Those transactions included Hertz car rentals and ID scans at Planet 13 in Las Vegas.

IDScan.net announced an exclusive identity verification agreement with Planet 13 in 2022. The company says it processes more than 21 million verifications each month at more than 20,000 locations.

Its listed customers reportedly include Hertz, Target, FedEx, Motorola Solutions, Jack Henry, Caesars Entertainment, and more than 1,000 marijuana dispensaries in 19 states.

Shortly after the KrebsOnSecurity report was published, the Nexus website disappeared.

That does not mean the data is gone.

Criminal groups often copy and redistribute stolen data. A vanished marketplace may simply mean the information moved somewhere else.

Generic driver's license being offered to an identity scanner at a rental counter

The real problem is centralized identity verification

The disturbing part is not only the number.

It is how little control you have.

You hand over your license at a rental counter. A hotel. A dispensary. A store return desk. A financial institution. An age-verification kiosk.

You may not know:

Whether the ID is scanned or only viewed
Whether a copy is stored
How long the scan is retained
Which third-party vendor processes it
Who can access the vendor's systems
Whether the information is deleted after verification

You may never interact with IDScan.net directly. You may not even know the business uses it.

One vendor can sit quietly between thousands of businesses and millions of customers. If that vendor fails, the exposure spreads across the entire network.

That is the fragility of centralized identity systems.

Real ID requirements and expanding age-verification systems may increase the number of times your government-issued identification is scanned. More scans create more stored copies. More stored copies create more opportunities for theft, misuse, and unauthorized access.

You cannot personally audit every vendor.

You can, however, reduce the damage.

Assume you may be affected

The exact list of victims is not public. IDScan.net has said its investigation is preliminary and has not confirmed the nature or scope of the incident.

Do not wait for a notification letter.

Given the size of the reported dataset, the practical move is to treat your driver's license information as exposed until investigators provide better information.

That does not mean panic. It means taking the same approach you would use after losing control of a sensitive credential.

Your goal is not to prove whether your specific license is listed. Your goal is to make identity theft harder.

Your immediate action plan

1. Freeze your credit at all three bureaus

A credit freeze is free. It does not affect your credit score. It stays in place until you lift it.

A freeze makes it much harder for someone to open new credit accounts in your name.

Place a separate freeze with:

You must contact all three. Freezing one report does not freeze the others.

When you need to apply for credit, temporarily lift the freeze with the bureau the lender uses. Then restore it.

Also consider specialty reporting agencies:

ChexSystems for checking and savings account fraud
NCTUE for certain telecommunications and utility accounts

These are separate from the major credit bureaus. A freeze at Equifax, Experian, or TransUnion does not automatically protect specialty reports.

2. Place a fraud alert

A fraud alert tells businesses to take additional steps to verify your identity before opening new credit.

You only need to contact one of the three major credit bureaus. That bureau must notify the other two.

An initial fraud alert is free and generally lasts one year. If you have confirmed identity theft and complete an FTC identity theft report, you may qualify for an extended fraud alert lasting seven years.

A fraud alert is useful.

It is not a substitute for a freeze.

3. Pull your credit reports

Use AnnualCreditReport.com to review your reports from all three bureaus.

Look for:

Accounts you do not recognize
Hard inquiries you did not authorize
New addresses
Unknown employers
Collection accounts
Changes to existing accounts
Credit cards or loans opened recently

Save copies for your records.

Check again regularly. Identity theft may not happen immediately after a data exposure.

4. Watch for account takeover

A driver's license scan may contain enough information to make social engineering more convincing.

Be alert for messages claiming to be from:

Your bank
A credit bureau
A lender
A government agency
A car rental company
A security or identity monitoring provider

Do not click unexpected links. Do not provide one-time passcodes. Do not trust a caller just because they know your name, address, or date of birth.

Contact the organization through its official website or the phone number on your card.

Turn on free account alerts through your banks and credit cards. Enable notifications for:

Password changes
New device logins
Wire transfers
New payees
Large purchases
Address changes
Credit applications

Monitoring helps you notice problems.

It does not prevent the problem.

5. Rethink unnecessary ID scans

You may not be able to refuse every scan. Some transactions require identity verification.

But you can ask questions.

Before handing over your license, ask:

Why do you need to scan it?
Is a physical inspection enough?
Who processes the scan?
How long is it retained?
Is the data deleted after verification?
Can you cover unnecessary information or the barcode?

Do not alter your license or obstruct legally required verification. But when a scan is optional, understand what you are agreeing to.

Minimizing exposure is part of taking back control.

Folders, a phone with generic security alerts, and a small lock representing credit protection

What about physical documents?

This incident involves digital scans. But physical paperwork still creates risk.

Shred old insurance cards, account statements, expired identification copies, and mail containing personal information.

A cross-cut shredder is useful for routine household documents. An RFID-blocking organizer can also help protect contactless cards and passports from nearby electronic scans.

For example, the Lewis N. Clark RFID document organizer on Amazon includes multiple compartments for travel documents and states that it blocks 13.56 MHz frequencies used by many contactless cards and passports.

Be clear about the limits.

An RFID wallet cannot stop a business from saving a digital image of your driver's license. It protects against a different threat: unauthorized contactless reading.

Use the right tool for the right problem.

Should you buy identity theft protection?

Maybe. But understand what you are buying.

Paid identity theft services may offer:

Credit and dark web monitoring
Alerts
Restoration assistance
Insurance benefits
Help disputing fraudulent accounts

That support can be valuable, especially for families, business owners, or people with limited time.

But no service can make an exposed driver's license private again.

Monitoring tells you after something changes. A credit freeze helps block new credit before it opens.

Start with the free steps:

Freeze your credit.
Place a fraud alert.
Review your reports.
Enable financial account alerts.
Secure your email and financial accounts with strong passwords and multifactor authentication.

Then decide whether paid assistance is worth the cost.

Build a broader privacy plan

The IDScan incident shows why privacy cannot depend on one company, one app, or one notification email.

You need practical systems.

Use unique passwords. Secure your primary email. Reduce unnecessary data sharing. Review old accounts. Remove exposed personal information where possible. Learn how your devices, accounts, and online identity connect.

Garvin Academy's Disappear Online course provides a step-by-step framework for hardening devices, protecting accounts, and reducing your digital footprint. The course was built by Forrest Garvin, a privacy and security expert with more than 20 years of real-world experience and a community leadership network of more than 100,000 members.

You do not need perfect privacy.

You need real action items that reduce your dependence on fragile systems.

Frequently asked questions

How do I know if I am affected?

You may not be able to know yet. IDScan.net has not publicly released a complete victim list, and the investigation is ongoing.

If your license was scanned at a business that used IDScan.net, your risk may be higher. But because the reported dataset is so large, the safest approach is to act as if you may be affected.

Is freezing my credit free?

Yes. Credit freezes at Equifax, Experian, and TransUnion are free. You must place the freeze separately with each bureau.

You can also lift or remove a freeze for free.

Does a fraud alert stop everything?

No.

A fraud alert asks lenders to take additional steps to confirm your identity. It does not block access to your credit report and does not prevent every type of fraud.

A freeze provides stronger protection against new-credit accounts.

What is the difference between a freeze and an alert?

A freeze restricts access to your credit report for most new-credit applications. You must contact all three bureaus.

An alert tells lenders to verify your identity more carefully. You contact one bureau, and it notifies the other two.

You can use both.

Should I buy identity theft protection?

Paid protection may provide useful monitoring and recovery support. It is optional.

Do not pay for a service before using the free protections available through the credit bureaus, the FTC, your banks, and AnnualCreditReport.com.

The most important step is not purchasing a product.

It is taking action today.

Final takeaway

The Nexus marketplace may be gone. The stolen copies may not be.

You cannot control every company that scans your license. You can control how difficult it is for criminals to turn that information into new debt, account takeovers, or financial damage.

Freeze your credit. Review your reports. Secure your accounts. Ask better questions before handing over your ID.

Invest in yourself.

Protect your identity.

Build independence one practical step at a time.

Sources

Post details

Excerpt: A reported Nexus marketplace exposed more than 153 million driver's license scans. Learn what the suspected IDScan breach means and the steps you can take now.
SEO title: IDScan Breach: 153 Million Driver's Licenses Exposed
Meta description: The reported IDScan breach exposed 153 million driver's license scans. Learn how to freeze your credit, spot fraud, and reduce identity theft risk.
Tags: IDScan breach, identity theft, driver's license breach, credit freeze, fraud alert, digital privacy, online security, identity protection
Featured image caption: A generic driver's license beside a secured smartphone, representing the risks of centralized identity verification.
Category: Privacy & Security

153 Million Driver's Licenses Hit the Dark Web: What the IDScan Breach Means for Your Identity