On August 31, 2026, security journalist Brian Krebs was offered a free sample by a seller on a Russian cybercrime forum: his own Virginia driver’s license, pulled from a dark web marketplace called “Nexus.” Within days, that discovery unraveled into one of the largest identity-document breaches on record — more than 153 million U.S. and Canadian driver’s licenses, sourced from a New Orleans identity-verification company whose scanners sit behind the counter at Hertz, Target, FedEx, and over a thousand marijuana dispensaries. If you’ve ever handed your license to a rental car clerk, a dispensary budtender, or a retail associate checking your age, there’s a real chance your ID is part of this. Here’s exactly what happened, what’s confirmed versus still unclear, and the specific steps worth taking this week.
Key Takeaways
- A dark web marketplace called “Nexus” was selling scanned images of over 153 million U.S. and Canadian driver’s licenses, plus 10+ million other ID cards and 3+ million travel documents, before it went offline shortly after being publicly exposed.
- The data traces back to IDScan.net, a Louisiana-based identity-verification vendor used by more than 1,000 marijuana dispensaries and by major brands including Hertz, Target, and FedEx to scan customer IDs at checkout or check-in.
- IDScan.net publicly confirmed the breach on September 8, 2026, saying an unauthorized third party “may have access and/or copied” customer information, and is offering free credit monitoring to affected individuals.
- The FBI’s New Orleans field office opened an investigation on September 1, 2026; it is ongoing and the bureau has declined to comment further.
- This is a breach at a private identity-verification vendor, not a hack of any state DMV or the federal REAL ID system — but it’s a direct consequence of how often government-issued ID images now get scanned and stored by third-party companies most consumers have never heard of.
What Actually Happened
The breach came to light through old-fashioned investigative reporting rather than a company disclosure. On August 31, 2026, a source alerted Brian Krebs of KrebsOnSecurity to a new listing on Exploit, a Russian-language cybercrime forum, advertising a searchable database of government-issued ID scans under the name “Nexus.” To prove the data was real, the seller offered Krebs a free sample: his own Virginia driver’s license.
Krebs traced the source by matching timestamps embedded in the scanned records — recorded in Greenwich Mean Time — against his own travel history, including a Hertz rental and a visit to a Planet13 dispensary. The scans also included infrared and ultraviolet imaging, a signature of the document-authentication technology used by IDScan.net, a New Orleans-based identity-verification company. That company’s scanners process ID checks for more than 1,000 marijuana dispensaries nationwide, along with major brands including Hertz, Target, and FedEx, verifying customer age or identity at the point of sale or rental.
The Nexus database, as documented by Krebs, contained roughly 11.5 million pages of searchable results and was growing fast — nearly 400,000 new license records were added within a single 24-hour period he observed. Shortly after Krebs published his findings, the Nexus marketplace disappeared from the dark web, replaced with a message reading “This service is no longer available.”
The Scale of What Was Exposed
| Document Type | Records Exposed |
|---|---|
| U.S. and Canadian driver’s licenses | 153+ million |
| Other identification cards | 10+ million |
| Travel documents / international IDs | 3+ million |
| Medical (dispensary) cards | 579,000+ |
| Canadian driver’s license records | 1.1 million (473,673 from Ontario alone) |
Each record wasn’t just a name and license number — it was a full image of the physical document, in most cases including the person’s photo, signature, address, date of birth, and license number, alongside the infrared/UV authentication scans IDScan.net’s technology captures automatically. That combination is far more valuable to an identity thief than a stolen password, because it can be used to convincingly impersonate someone for in-person or document-based verification, not just to log into an account.
How This Is Different From a Typical Password Breach
Most data breaches expose something you can change — a password, a security question answer, even a credit card number. A stolen government ID photo is a different category of problem: you can’t simply reset your face or reissue your date of birth. As our explainer on passkeys versus passwords lays out, one of the strongest arguments for moving away from shared secrets like passwords is that a breach at one company shouldn’t be able to compromise you everywhere else. A leaked driver’s license scan is the extreme version of that same problem: it’s a single, static, hard-to-replace credential that, once exposed, can be reused indefinitely by whoever has it — for opening fraudulent accounts, passing weak identity checks, or supporting other forms of impersonation.
It’s also worth being precise about what this breach is not. IDScan.net is a private identity-verification vendor that businesses contract with to check customer IDs — it has no connection to state DMV systems or the federal REAL ID program. If you’ve recently upgraded to a REAL ID-compliant license, that process and this breach are unrelated. But the two trends are connected in a broader sense: as ID-scanning becomes more routine at airports, car rental counters, dispensaries, and retail checkouts, more images of government identification end up stored — sometimes indefinitely — in the systems of third-party vendors most consumers never directly interact with or agree to.
What IDScan.net and the FBI Have Said
IDScan.net publicly confirmed the breach on September 8, 2026, stating that “an unauthorized third party may have access and/or copied certain customer information.” The company has not published specifics about which of its business customers, or which states, were affected, and it says it is reviewing potentially affected records. It is offering free credit monitoring and identity-protection services to individuals it determines were impacted, though it hasn’t detailed how those individuals will be identified or notified.
The FBI’s New Orleans field office confirmed it opened an investigation on September 1, 2026, the day after Krebs’s reporting went public, but has declined to comment further “due to the ongoing nature of the investigation.” Separately, Wisconsin’s Department of Agriculture, Trade and Consumer Protection said it had not been formally notified of the breach and had received no consumer complaints as of mid-September — an early sign that official state-level breach notifications may still be catching up to the scale of what’s been reported. Security researcher Zach Edwards, commenting on the broader pattern behind incidents like this one, put it bluntly: “these systems are putting sensitive data into more and more 3rd party vendors, and we don’t have nearly the oversight to ensure they are safe.”
What to Do If You Might Be Affected
There is currently no public tool to check whether your specific driver’s license is in this dataset, and IDScan.net has not released a list of which business customers or states were involved. Given the scale — over 153 million U.S. and Canadian records — anyone who has shown a driver’s license to rent a car, buy age-restricted products, or complete an ID check at a business using third-party verification technology in recent years should treat this as a realistic possibility rather than a remote one. A few concrete steps are worth taking regardless of whether you can confirm your own exposure:
Freeze your credit at all three bureaus
A credit freeze is free and blocks new creditors from accessing your credit report at all, which stops most attempts to open new accounts in your name. It has to be placed separately with each of the three major bureaus:
| Credit Bureau | Phone Number |
|---|---|
| Equifax | (888) 298-0045 |
| Experian | (888) 397-3742 |
| TransUnion | (800) 916-8800 |
Place a fraud alert as a lighter-weight alternative
If a full freeze feels like too much friction, a fraud alert placed with just one bureau (the other two are automatically notified) requires lenders to verify your identity before extending credit. A standard alert lasts one year; an extended alert, which typically requires a police report, lasts seven.
Check your driving record and consider your options with your state DMV
Because the exposed images include your driver’s license number, it’s worth checking your state driving record for anything unfamiliar and contacting your DMV to ask whether license-number-specific fraud alerts or reissue options are available — policies vary significantly by state.
Report it federally if you find evidence of misuse
If you spot signs of actual identity theft — unfamiliar accounts, collection notices, or denied credit applications you didn’t initiate — file a report at IdentityTheft.gov or call the FTC at 877-438-4338. That report creates an official recovery plan and can support disputes with creditors and credit bureaus.
Take IDScan.net’s monitoring offer if it reaches you, but don’t wait on it
IDScan.net says it will offer free credit monitoring to individuals it identifies as affected, but the company hasn’t detailed its notification timeline or method. Given the scale of the exposure and the slow pace of individual notifications in breaches like this historically, it’s reasonable to take the precautions above now rather than wait for a letter that may or may not arrive promptly.
Why This Matters Beyond the Individual Breach
For businesses that rely on third-party identity-verification vendors — for age-restricted sales, rental agreements, or know-your-customer checks — this breach is a reminder that outsourcing ID verification also means outsourcing a piece of your customers’ most sensitive data to a company you may have limited visibility into. Before choosing or continuing with a verification vendor, it’s worth asking directly how long scanned ID images are retained, whether they’re deleted after verification completes, and what independent security auditing the vendor undergoes — questions that, based on this incident, a meaningful share of businesses using these tools likely haven’t asked.
FAQ
What is the IDScan.net data breach?
A breach at IDScan.net, a New Orleans-based identity-verification company, that led to more than 153 million U.S. and Canadian driver’s license images being sold on a dark web marketplace called “Nexus.” The company confirmed the breach on September 8, 2026.
How do I know if my driver’s license was part of this breach?
There is currently no public lookup tool, and IDScan.net has not released which business customers or states were affected. Anyone who has shown a driver’s license to a business using ID-scanning technology — including Hertz, Target, FedEx, or a dispensary — in recent years should treat exposure as a real possibility and take precautionary steps.
Was this a hack of state DMV records or the REAL ID system?
No. IDScan.net is a private company that businesses use to verify customer identity documents; it has no connection to state motor vehicle databases or the federal REAL ID program.
What should I do first if I think I was affected?
Placing a free credit freeze with Equifax, Experian, and TransUnion is the single most effective step, since it blocks new creditors from accessing your credit report entirely. A fraud alert, checking your driving record with your state DMV, and monitoring for unfamiliar accounts are useful next steps.
Is the Nexus dark web marketplace still active?
No. It went offline shortly after Brian Krebs of KrebsOnSecurity published his findings, displaying a message that the service was “no longer available.” Whether the underlying data has stopped circulating elsewhere is unknown.
Which businesses used IDScan.net?
Public reporting has confirmed IDScan.net processes ID verification for more than 1,000 marijuana dispensaries nationwide, along with Hertz, Target, and FedEx. IDScan.net has not published a full list of its business customers.
The Bottom Line
This breach is notable less for any single new tactic than for its scale and what it exposed: not passwords or card numbers, but the actual scanned images of the ID documents 153 million people used to rent a car, buy a product, or prove their age. That kind of data can’t be reset the way a password can, which is exactly why the response matters more than usual — a credit freeze, a fraud alert, and a closer look at your driving record are worth doing now, whether or not you ever receive a formal notification. And for any business that hands a vendor its customers’ government-issued IDs to scan and store, this is a concrete reason to ask exactly how that data is protected, not just how convenient the verification process is.
This article reflects publicly reported facts as of publication and will be updated if IDScan.net, the FBI, or affected states release further details.
