IDScan.net confirmed a data security breach on September 4, 2026, after the dark web service Nexus was found selling over 153 million driver’s license scans tied to IDScan’s identity verification clients. The exposure window runs from approximately June 2025 to September 1, 2026. Affected individuals face risks including identity fraud, document forgery, and physical access credential abuse. Businesses using identity verification vendors now face significant third-party security questions.
What IDScan.net Actually Does and Why This Is a Supply Chain Problem
IDScan.net is a Louisiana-based identity verification company. Its software scans driver’s licences and ID documents at physical locations , not just a quick photo but multi-spectrum scans including the front, the back, infrared, and ultraviolet versions. Those UV and infrared scans reveal security features embedded in modern government-issued IDs that a basic camera can’t detect.
The company’s clients include Hertz car rental locations, Target, FedEx, and Planet13 cannabis dispensaries across the United States. When you hand your licence to a Hertz agent at an airport counter, or scan it at a dispensary door, the verification system may be IDScan.net’s software and until recently, those scans were apparently being exfiltrated and stored in a database that a dark web seller was offering for $100 per record.
This is definitionally a supply chain attack. IDScan.net sits between the businesses its clients trust and the individuals those businesses serve. A single compromise at the vendor level exposes the complete chain downstream. Neither Hertz employees nor Planet13 customers chose to share their documents with whoever ran Nexus but IDScan.net’s position in the middle made that transfer possible without anyone’s knowledge or consent.
The 15-Month Exposure Window
Barracuda’s October 20 analysis of the breach introduced one specific detail that wasn’t in the initial coverage: the exposure window.
The Nexus database was apparently being actively updated with new records right up until it went offline on September 1, 2026. Based on the timestamps embedded in the stolen records, the data collection appears to have begun around June 2025 and continued for roughly 15 months. The database was still growing when KrebsOnSecurity’s investigation triggered enough attention that the operators took it down.
What that means practically: if you scanned your driver’s licence at any IDScan.net client location between June 2025 and September 1, 2026, your information should be treated as potentially compromised.
Before our original coverage in September, that window wasn’t publicly defined. The confirmation from IDScan.net combined with the Nexus timeline establishes it.
Why a Stolen Driver’s Licence Is Uniquely Dangerous
Most data breaches expose email addresses, passwords, or credit card numbers. All of those are serious, and all of them can be changed or cancelled. A driver’s licence is different.
A full multi-spectrum scan of your driver’s licence front, back, infrared, ultraviolet provides the forensic detail required to forge a convincing replica. That replica could pass both human visual inspection and digital verification systems designed to catch fakes. Barracuda’s Andrew Sanders notes this specifically: the Nexus records were offered at “a forensic level of detail” that could make it easy to forge IDs that “pass both visual and digital inspection” , including Real ID card.
With a convincing copy of your licence, a fraudster could apply for unemployment benefits, open credit accounts, obtain a bank loan, or claim prescription drugs. These forms of fraud don’t necessarily show up on a credit report quickly, and traditional credit monitoring tools may not catch them before damage is done.
For anyone whose records included a physical access credential , a government building badge, a site security pass, or a Common Access Card (CAC), the risk extends beyond identity fraud into physical security. If the stolen document includes the data needed to clone an access card, someone could enter a facility whose security systems expected to see your credential. Barracuda’s guidance is explicit on this point: contact your security manager immediately for credential revocation.
The same synthetic identity fraud market we’ve covered through 2026 , where fake identities built on partial real data sell for as little as $200 , benefits directly from full multi-spectrum driver’s licence scans. With your name, address, date of birth, and a scan that passes UV inspection, building a fraudulent identity becomes significantly easier for criminal actors.
Nexus Is Down, But the Data Isn’t Gone
The Nexus dark web service going offline on September 1 is not the same as the data being recovered or destroyed.
When a dark web marketplace or data service pulls its listings, it typically means one of a few things: the operators are spooked by attention, a law enforcement action is underway, or the operators are moving the business to a more private channel. What it doesn’t mean is that the data no longer exists or has been deleted.
In the IDScan case, the FBI confirmed it was investigating, and the bureau made contact with Brian Krebs after finding that an FBI assistant director’s licence was among the records on offer. That investigation is ongoing. But even successful law enforcement action against the operators doesn’t retrieve 153 million records that have potentially been downloaded or copied by buyers across the months the service was active.
As we’ve covered in our guide on whether data can be removed from the dark web, the window for meaningful containment of a breach typically closes long before public awareness catches up. The best anyone can do now is limit how much damage the already-circulating data can cause.
What Individuals Should Do Right Now
Monitor for identity fraud beyond credit. Credit freezes help. But licence-based fraud often shows up in areas credit bureaus don’t monitor: benefits claims, utility accounts opened in your name, and state-agency transactions. Set up monitoring alerts with your bank and review statements from any account linked to your name.
Check your DMV record. Some states allow you to view activity on your driver’s licence through an online portal. Check for any changes, flags, or duplicates you didn’t authorise.
Contact your employer’s security team if you had any work access credentials scanned. Don’t wait for formal notification. If your badge or access card was scanned at any IDScan.net client for identity verification purposes, assume the credential data may need to be rotated.
Report identity fraud to the FTC at IdentityTheft.gov if you believe your information has already been misused. The FTC produces a personalised recovery plan and formal documentation useful for disputing fraudulent accounts.
Check Have I Been Pwned for your email address. If IDScan.net’s breach data is added to HIBP’s database, you’ll receive an alert.
What Businesses Using Identity Verification Vendors Should Do
Barracuda’s analysis raises a question that any business using IDScan.net or similar services now needs to ask: what data does our identity verification vendor actually retain, where is it stored, how long is it kept, and who has access to it?
The IDScan.net breach is a textbook illustration of why identity verification providers should be treated as high-risk vendors within a security programme. They aggregate sensitive documents from many businesses and users in one place. A single compromise at that vendor reaches every downstream customer.
Businesses should review contracts with identity verification providers for breach notification timelines, data deletion requirements, audit rights, and minimum security standards. They should also assess whether help-desk and account recovery procedures currently treat a driver’s licence scan as sufficient proof of identity , because this breach has demonstrated that those scans can be forged convincingly.
Frequently Asked Questions
Did IDScan.net confirm the breach?
Yes. IDScan.net confirmed a data security incident on September 4, 2026, through its official notification page and by filing breach notices with state attorneys general.
When was data being collected?
The Nexus service was actively adding records from approximately June 2025 until it went offline on September 1, 2026, a roughly 15-month window.
Is my data safe now that Nexus is offline?
Not necessarily. Nexus going offline means the public marketplace is gone, but the data may have been downloaded by buyers or moved to private channels. The FBI investigation is ongoing.
What if my driver’s licence was a physical access credential?
Contact your security manager immediately to have the credential rotated or revoked. Don’t wait for formal notification.
