More than 150 million images of driver’s licenses, state IDs and medical dispensary cards, according to the Identity Theft Resource Center. That is the figure attached to a breach at IDScan.net, a Louisiana identity verification company, and the detail that matters is that these are full images, not rows in a database.
IDScan.net sells technology to businesses that need to check a customer’s ID, whether to sell alcohol or rent a car. In a data security notice on its website, it said that around Sept. 1 an unauthorized third party may have accessed or copied customer information stored in its accounts. That information may include full names and driver’s license or other government ID numbers. The notice did not mention images.
What the images look like
James Lee, president of the Identity Theft Resource Center, told WBAY the volume was striking. “We’ve been told that there’s in excess of 150 million images of driver’s licenses, state IDs, and medical dispensary cards,” he said. “But what’s really interesting about this breach, and what makes it very risky for people, is these are the full images of driver’s license.”
Under the hood, that means the photo, the address and the birth date, all in one file.
KrebsOnSecurity traced where such files were turning up. A newly launched dark web service called Nexus claimed more than 153 million U.S. and Canadian driver’s licenses, plus over 10 million ID cards and at least 579,000 medical cards. A blank search returned roughly 11.5 million pages of results. Its operators said the images came from an active breach at “a major identity verification company” and that they had been pulling data for over a year.
The reporter’s own record held six image files, including infrared and ultraviolet scans, each stamped with a date and time. Nine relatives and friends who found their licenses on the service said the timestamps matched trips on which they had handed over a license, several of them at Hertz rental counters. IDScan.net lists Hertz among its clients and says its systems run more than 21 million verifications a month at over 20,000 locations. Caesars Entertainment, also listed, told the site it has not been a client and has not used IDScan’s VeriScan since February 2025.
Shortly after Krebs published, the Nexus site went dark, replaced by a line reading “This service is no longer available.”
Who is looking into it
Neither IDScan.net nor its client companies have said which customers were exposed. The FBI told Action 2 News: “The FBI can confirm that it is looking into the incident. Due to the ongoing nature of the investigation, we decline to comment further.” Krebs reported that the bureau’s New Orleans field office opened its inquiry on Sept. 1. IDScan.net later said it is notifying affected people and offering credit protection.
Wisconsin’s Bureau of Consumer Protection said it was not notified and has received no related complaints. “We do not have any additional information to provide other than what can be found from IDScan’s website,” the agency said.
Lee’s advice was blunt. “Make your information less useful to the identity criminal,” he said. “Don’t wait to have some sort of notice. Go ahead and freeze your credit because that stops new credit from being issued in your name.”
The Wisconsin DMV added that scam victims can file a police report, report to the Federal Trade Commission or ic3.gov, and request a free credit report.
Sources
- FBI Probes Service Selling 153M+ Drivers Licenses
- IDScan.net Data Breach Exposed 150M Driver's Licenses | Alex Achten posted on the topic | LinkedIn
- Data breach at ID verification company may have exposed millions of driver’s license images
