FBI Probes Identity Service Selling 153M+ Driver's Licences, Traced to idscan.net
Summary
A new dark-web identity-theft service, Nexus, launched on the Russian Exploit forum offering digital scans of more than 153 million US and Canadian driver's licences — the single largest identity-theft dataset claim of the year. Krebs on Security's forensics traced the scans back to idscan.net, a Louisiana identity-verification firm, and the FBI's New Orleans field office opened an official investigation.
Key Facts
- Dataset: Over 153 million US and Canadian driver's licences, over 10 million identification cards, 3 million travel documents and 579,000 medical cards — growing by ~400,000 in 24 hours, suggesting ongoing exfiltration.
- Origin: Timestamps traced to idscan.net, which performs 21 million verifications monthly; clients include Hertz, Target, FedEx, Motorola, Jack Henry and Caesars.
- Status: idscan.net confirmed it is investigating a potential security incident, notifying clients and engaging forensics and counsel. Probable breach pending disclosure.
- Verified contents: Records include Defence Secretary Pete Hegseth's licence and the FBI Assistant Director's.
Significance
For Australian agencies and firms, the compromise class — domestic identity-verification chains that scan licences and passports for onboarding — is identical, so third-party ID-vetting vendors should be reviewed under supplier risk obligations.
Update — 11 September 2026: IDScan confirms the breach
IDScan confirmed the intrusion in a security notice published on 4 September 2026 — the company says it became aware on or around 1 September — and configured that page with a noindex directive that kept it out of search engines until TechCrunch reported it on 10 September. The notice states that "an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud", with affected data potentially including full names and driver's licence or other government-issued identification numbers. IDScan has not said how many customers were affected, is cooperating with federal law enforcement, and is offering 12 months of credit monitoring and identity protection. Several class actions have been filed.
The company has downplayed the incident on the basis that full access to the data required payment, and the Nexus service disappeared from the dark web shortly after Krebs published — though its operators have not claimed to have deleted the data, and multiple actors have since offered the full database for sale, which BleepingComputer has been unable to confirm as genuine.
Analyst framing matters here: because licence records are key identity documents whose numbers appear across other databases, the dataset's intelligence value exceeds its fraud value. Risky Business's Tom Uren has argued the breach is a national-security disaster rather than a routine cybercrime event, drawing the comparison to the mid-2010s Chinese espionage campaigns against Anthem, Equifax, Marriott, United Airlines and the Office of Personnel Management, where complementary datasets were stolen from separate sources and correlated. The service's continuous ingestion — Krebs observed the database growing by nearly 400,000 licences in a single day — indicates more than a year of ongoing exfiltration rather than a one-off dump.
Source
Update — 23 September 2026: Canada's privacy regulator opens an investigation
The Privacy Commissioner of Canada, Philippe Dufresne, announced on 21 September 2026 that he has opened an investigation of IDScan.net. The probe will examine both the company's security practices and, separately, whether its notifications to affected individuals met the requirements of Canada's federal private-sector privacy law — a question regulators increasingly ask independently of the breach itself, because the adequacy of notification is where most enforcement action is ultimately grounded.
IDScan told users on 4 September that hackers had obtained user data held in its cloud platform and did not say how many customers were affected; the company learned of the incident on or around 1 September, hours after Brian Krebs revealed the scans were for sale on the dark web. The vendor continues to face class actions in the United States, and the Canadian investigation is the first regulatory action of which the wiki is aware across either jurisdiction.
For Australian and New Zealand organisations using third-party identity-verification vendors, the development reinforces the supplier-risk point made in the September analysis above: the enforcement exposure is not limited to the security failure, it extends to how the vendor informs the people whose documents it holds.