Identity-verification vendor IDScan.net has confirmed that hackers accessed customer data on its systems, following reports that a dark-web marketplace was selling more than 153 million scanned driver's licenses traced back to the Louisiana-based company. The confirmation, issued in a security notice on September 8, caps a week in which security researchers and the FBI raced to identify the source of one of the largest known breaches of government identification documents.
The trove was first spotted by security journalist Brian Krebs, who reported that a new criminal service called "Nexus," advertised on the Russian-language forum Exploit, was selling access to a database that also included more than 10 million ID cards, 3 million travel documents and 579,000 medical cards, alongside the driver's license scans. According to Krebs's reporting, the FBI's New Orleans field office opened an investigation on September 1, and the Nexus listing disappeared from the dark web the following day, though the operators are believed to still hold copies of the stolen data.
A Vendor Behind the Scenes
IDScan.net verifies identity documents for retailers, car-rental counters, hotels and other businesses that need to check a customer's age or identity, and its client list has included Hertz, Target, FedEx and Caesars Entertainment, along with more than a thousand cannabis dispensaries across 19 states that use age-verification scanning at the point of sale. Investigators traced portions of the leaked data to identity checks performed at rental-car desks and dispensary counters, with timestamps on some scans matching real travel dates and infrared and ultraviolet image variants — the kind of forensic detail typically captured only by professional ID-scanning hardware.
In its notice, reported by BleepingComputer, IDScan said it learned "an unauthorized third party may have access and/or copied certain customer information" around September 1, and that it had "taken immediate steps to secure our systems and engaged a team of third-party specialists" to determine the scope of the breach. The company said it is notifying affected individuals and offering complimentary credit monitoring and identity-protection services, though BleepingComputer noted that repeated attempts to reach IDScan for further comment went unanswered.
Security researcher Larry Baldwin, who reviewed samples of the leaked database, said it "presents multiple serious security and privacy threats" beyond ordinary identity theft, warning that exposed driver's license data can be exploited for credit fraud and can put domestic-violence survivors and witness-protection participants at heightened risk if their current addresses or new identities are traceable through old scans.
The FBI's investigation remains active, and it is not yet clear how many of the 153 million license scans belong to unique individuals or whether the stolen data has already been resold beyond the shuttered Nexus platform. For now, the incident adds IDScan to a growing list of identity-verification vendors whose back-end systems — rather than the retailers and government agencies they serve — have become the weak point in document-checking infrastructure used across everyday commerce.
