IDScan confirms breach in noindexed notice, as reports peg leaked database at 153 million licenses
The company says it learned on or around September 1 that data in customer accounts on its cloud may have been copied, and its notice lists names and ID numbers but not the licence scans Nexus was selling.
The Watch · Security desk
What happened
- Brian Krebs reported on September 1 that a dark-web platform called Nexus was advertising access to more than 153 million U.S. and Canadian driver's licence scans.
- IDScan then published a September 4 notice saying it learned on or around September 1 that certain data in its cloud accounts may have been accessed without authorization.
- TechCrunch found that notice configured with a noindex directive, which instructs search engines not to index the page.
- IDScan says it is cooperating with federal law enforcement, and the FBI confirmed to BleepingComputer that it is investigating the incident.
Why it matters
- Who's exposed exposure Businesses across the platform's customer base, from dispensaries to dealerships to gun shops, now owe notifications on records they never held themselves, on a clock that started at a vendor's discovery date.
- What it limits constraint A business drafting its own notice from IDScan's stated categories would tell people their name and licence number moved and omit the document image reportedly in circulation.
- Who has to decide decision Anyone buying KYC or age-verification tooling has to treat image retention in the vendor's cloud as a contract term, because it sets the size of the next disclosure rather than the vendor's.
- What it sets up precedent A notice a search engine is told to skip leaves downstream businesses as the only route by which an affected individual hears about it, which is the route regulators will grade.
Next story · Product · Sep 11
IDScan.net's breach notice puts 153 million licenses in cloud accounts it kept after the checkConfirmed5 publishers
The product is why the aggregate exists. IDScan sells technology businesses use to scan, authenticate and extract data from government-issued IDs [12], and its platform is used by car rental companies, retailers, financial institutions, cannabis dispensaries, gun shops and hospitality businesses [13]. Those records sit in accounts on the IDScan.net cloud, which is where the company says an unauthorized third party may have accessed or copied customer information [2]. One platform reaches every vertical.
Add the Nexus listing up. Alongside the 153 million driver's licence scans [10], the service allegedly held 10 million ID cards, 3 million travel documents and 579,000 medical cards [11], or 166,579,000 documents advertised [20]. IDScan has confirmed none of those numbers. Its notice gives categories, not volume, and the categories are full names and driver's licence or other government-issued identification numbers [5]. The licence images themselves, which BleepingComputer reports were also stolen, do not appear in it [7].
The linkage is stronger than the count. Brian Krebs verified samples from the database by searching for his own records and those of people who consented, then traced the exposed information back to IDScan [3]. That establishes provenance. How many records the set actually holds remains uncounted by anyone outside the investigation.
Discovery is dated on or around September 1, the notice September 4, three days later [4][21]. In that window BleepingComputer reported that multiple lawsuits had already been filed [18] while IDScan had neither acknowledged the incident publicly nor answered questions [19]. The notice, when it came, carried a noindex directive [8], so an individual searching to find out whether their licence is in the set would not be served the company's own disclosure.
No intrusion vector is public. IDScan says it took immediate steps to secure its systems and engaged third-party specialists [17], and that it is cooperating with federal law enforcement [6]. IDScan's statement does not say whether a business's own account credentials or API keys were the path in, which leaves credential rotation a precaution rather than a fix.
The company's mitigating detail is that full access to the exposed information required payment, and that it is notifying potentially impacted individuals in an abundance of caution with free credit monitoring and identity protection [9]. Nexus itself went offline once the reporting spread, and BleepingComputer's read is that the criminals likely still have the database [14]; several other actors have since claimed to be selling the entire set, which BleepingComputer could not confirm [15]. Requiring payment sets a price per lookup; how many copies of the set now exist is a separate question the payment wall does not answer.
What to watch
- An amended IDScan notice that confirms a record count would move 153 million from a marketplace listing to a company statement.
- State attorney general filings from IDScan's business customers would show how the notification duty is being split downstream.
- Validation of any actor now claiming to sell the full set would show the copies have spread past the original Nexus operators.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence74
- Adoption62
- Hype gap+14
- Incentives71
- Confidence70
Perspective Coverage
6 publishers- Builder
- Builder 17%
- Operator
- Operator 52%
- Investor
- Investor 31%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Identity verification company IDScan confirmed that hackers accessed customer data stored in its cloud platform.
- [2]
IDScan says its investigation remains ongoing but has determined that an unauthorized third party may have accessed or copied customer information stored within accounts on the IDScan.net cloud.
- [3]
Krebs verified samples from the database by searching for records belonging to himself and others who consented to the searches, and traced the exposed information back to IDScan.
- [4]
IDScan disclosed the incident in a September 4 security notice, saying it learned on or around September 1 that certain data may have been accessed without authorization.
- [5]
Per IDScan's notification, the exposed information can include customers' full names and driver's license or other government-issued identification numbers.
- [6]
IDScan said it is cooperating with federal law enforcement, and the FBI previously confirmed to BleepingComputer that it was investigating the incident.
- [7]
While not mentioned in IDScan's notification, the breach reportedly also allowed threat actors to steal scans of driver's licenses.
- [8]
TechCrunch spotted IDScan's breach notification, which was published on September 4 but configured with a noindex directive that instructed search engines not to index the page.
- [9]
IDScan said that although full access to the exposed information required payment, it is notifying potentially impacted individuals in an abundance of caution and providing free credit monitoring and identity protection services.
- [10]
Brian Krebs reported on September 1 that a dark-web platform called Nexus was advertising access to more than 153 million U.S. and Canadian driver's license scans.
- [11]
The Nexus service also allegedly contained 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
- [12]
IDScan provides identity verification technology that businesses use to scan, authenticate, and extract information from government-issued identification documents.
- [13]
IDScan's platform is used by car rental companies, retailers, financial institutions, cannabis dispensaries, gun shops, and hospitality businesses.
- [14]
After news of the Nexus service spread the platform was taken offline, though per BleepingComputer the cybercriminals likely still have access to the database.
- [15]
Multiple threat actors have since claimed to be selling the entire database, but BleepingComputer has not been able to confirm whether these sales are legitimate.
- [16]
BleepingComputer has contacted IDScan multiple times with questions about the incident but has not received a response.
- [17]
IDScan said: "Upon this discovery, we took immediate steps to secure our systems and engaged a team of third-party specialists to help determine the full nature and scope of the incident."
- [18]
BleepingComputer reported on September 4 that multiple lawsuits had been filed against IDScan after hackers allegedly breached the company and offered access to a database containing more than 153 million driver's licenses.
- [19]
At the time of the September 4 lawsuit report, IDScan had not publicly acknowledged the incident or responded to BleepingComputer's requests for comment.
- [20]
The Nexus listing as reported totals 166,579,000 documents.
- [21]
Three days separate IDScan's stated discovery date and the publication of its notice.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comIDScan confirms breach tied to 153 million stolen driver’s licenses
2 articles · September 10, 2026
- cyberinsider.comIDScan confirms breach linked to massive driver’s license leak
1 article · September 10, 2026
- gadgetreview.comIDScan Leaked Driver’s Licenses. Now It’s Offering Free ID Protection. - Gadget Review
1 article · September 11, 2026
- helpnetsecurity.comIDScan confirms breach after 153 million driver’s licenses leak on dark web
2 articles · September 11, 2026
- confirmed it is investigating
idscan.net
1 article · September 9, 2026
- risky.bizSrsly Risky Biz: America's drivers licence breach is a national security disaster
2 articles · September 10, 2026