A major IDScan data breach has exposed the identity documents of more than 153 million people, after hackers reportedly maintained access to the ID verification firm’s systems for around a year. Anyone who has used a driving licence to verify their identity, whether in person or online, may have had their details compromised.
IDScan confirmed the incident in a statement issued on 4 September. “On or around Sept. 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorisation,” the company said. It added that it took immediate steps to secure its systems and engaged third-party specialists to determine the full nature and scope of the incident.
What data was taken
Security researcher Brian Krebs reported that a hacker had advertised digital scans of identity documents belonging to more than 170 million people through a service called Nexus, posted on a Russian cybercrime forum. Krebs was able to access Nexus and verify that it held the documents claimed, including a scan of his own driving licence.
The stolen records include 153 million driving licences, 10 million ID cards, 3 million travel documents such as passports, and at least 579,000 medical cards. Most records relate to US residents, though around 1.1 million Canadian driving licences were also found. Hackers most likely obtained full names, driving licence numbers and government-issued ID numbers, according to IDScan.
Those behind Nexus claimed they had been “continuously exfiltrating new data for over a year” into a private database from a major identity verification company. The information probably originated from a range of sources. Companies that use IDScan include Hertz, FedEx, Target, GameStop and more than 1,000 cannabis dispensaries, car rental agencies and gun shops across 19 states. IDScan reported that it scanned 150 million IDs in 2024 alone.
What you can do to stay protected
The New Orleans field office of the FBI is investigating the matter. IDScan says it will notify everyone affected by the breach and provide access to free credit monitoring and identity protection services. Affected individuals can contact the company on 1-833-516-2980 (Monday to Friday, 8 a.m. to 8 p.m. ET) to enrol in those services.
Anyone concerned they may be affected has several options. The quickest is a credit freeze, which makes it far harder for cybercriminals to open new accounts in your name. Freezing your credit is free but requires setting up individual accounts with each of the three major credit bureaus.
Because cybercrime can strike at any time, it is also wise to follow basic security practices, including using strong passwords, familiarising yourself with the latest AI-powered phishing scams and considering a VPN to help protect your connection. IDScan reported that the unauthorised access was first identified on or around 1 September 2026.
