Massive Data Breach at IDScan: Over 153 Million Driver’s Licenses Stolen

Identity verification company IDScan has confirmed a significant data breach, one of the largest in U.S. history. The breach involves the theft of over 153 million driver’s license scans from its cloud platform. IDScan, a Louisiana-based firm, is a popular choice among hotels, car rental agencies, and other businesses for customer ID verification. The breach was disclosed following the discovery of a dark-web marketplace named “Nexus” advertising the stolen database for sale by security journalist Brian Krebs.

The compromised data encompasses customers’ full names, driver’s license numbers, and government-issued identification numbers from passports and other documents. This breach affects both U.S. and Canadian residents. Disturbingly, the stolen files reportedly include infrared and ultraviolet image captures of licenses, the same layers used by scanners to authenticate whether an ID is genuine. The database was discovered on September 1, 2026, and IDScan issued a security notice three days later. Among those whose IDs were found in the breach was U.S. Defense Secretary Pete Hegseth, prompting an investigation by the Defense Department.

IDScan has responded by engaging third-party cybersecurity specialists and is cooperating with federal law enforcement, including the FBI. The company is notifying affected individuals and offering free credit monitoring and identity protection services. However, multiple lawsuits have already been filed against the company. Cybersecurity experts warn that unlike passwords, driver’s license numbers cannot simply be changed. This leaves affected individuals vulnerable to identity theft for years to come.

Source: TechCrunch – IDScan Confirms Data Breach with 150M+ Driver’s Licenses Stolen