Massive Drivers-License Data Breach Prompts FBI Investigation

A new identity-theft service called Nexus appeared on a Russian cyber-crime forum in early September 2026, advertising digital scans of more than 153 million driver’s licenses from the United States and Canada, plus over 10 million ID cards, 3 million travel documents, and 579 000 medical cards. A blank search returned about 11.5 million result pages, and within 24 hours the listing grew by nearly 400 000 records, indicating ongoing exfiltration.

Krebs on Security

The breach appears linked to idscan.net, a Louisiana-based identity-verification provider that serves organizations such as Hertz, Target, FedEx, the U.S. Coast Guard, and Planet 13 dispensaries. idscan.net’s technology scans IDs with infrared and ultraviolet light and processes more than 21 million verifications monthly at over 20 000 locations.

Krebs on Security

• 153 million driver’s licenses (U.S. and Canada) advertised for sale.

Krebs on Security

• 10 million other ID cards, 3 million travel documents, 579 000 medical cards.

Krebs on Security

• Search results suggest roughly 11.5 million pages of records, about 15 results per page.

Krebs on Security

• Canadian driver’s licenses total about 1.1 million records, with 473 673 from Ontario.

Krebs on Security

• The FBI confirmed it is “looking into the incident” and declined further comment.

Krebs on Security

• Jillian Kossman, marketing and operations leader at idscan.net, said the company is investigating and appreciated the updates provided to investigators.

Krebs on Security

• A Caesars Entertainment spokesperson noted the casino had not been a client of idscan.net since February 2025 and expected no impact from the breach.

Krebs on Security

• Nexus advertises about 170 million identity documents in total, while the verified count of driver’s licenses is 153 million; the discrepancy remains unreconciled.

Krebs on Security

• The precise source of the stolen data is “unclear.” idscan.net is a leading suspect, but no definitive attribution has been made.

Krebs on Security

• Timestamps on the scanned images are set to GMT, but the exact timezone used by the scanning devices has not been confirmed.

Krebs on Security

• “At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation,” — Jillian Kossman

Krebs on Security

• “Just when it seems like we’re making some headway in improving authentication controls through drivers license verification systems, this happens and the very thing those improvements are dependent on are compromised,” — Larry Baldwin

Krebs on Security

The FBI’s New Orleans field office has opened an investigation into the alleged breach involving idscan.net. The Nexus dark-web site disappeared shortly after these findings were published, displaying a notice that the service is no longer available. Investigators continue to trace the data pipeline, and additional updates are expected as the probe progresses.

USA Today