The FBI’s New Orleans field office opened an investigation on Sept. 1, 2026, into the source of driver’s-license images sold by Nexus, a dark-web service claiming scans of more than 153 million U.S. and Canadian licenses, KrebsOnSecurity reported. Krebs traced the images to IDScan.net, which later reported 13 million affected individuals to Oregon’s Department of Justice.
The two figures have not been reconciled in public. The 153 million number is the seller’s claimed record count. The 13 million number appears in IDScan.net’s entry in the Oregon DOJ data-breach database, which lists breach dates of April 1 to Sept. 2, 2026. IDScan.net’s own incident notice, updated Sept. 29, places the unauthorized access between April 4 and Sept. 2 and says it was limited to the company’s VeriScan platform. No CVE, software patch or public exploit is associated with the incident, and the vendor says its investigation is ongoing.
What was Nexus selling?
Nexus sold front-and-back scans of identity documents, including infrared and ultraviolet image variants, according to Krebs. Its operator claimed more than 153 million U.S. and Canadian driver’s licenses, more than 10 million ID cards, more than 3 million travel or international IDs and at least 579,000 medical cards. Buyers could preview records before purchase with key details redacted.
A new user advertised Nexus in a sales thread on Exploit, a Russian-language cybercrime forum, and posted Krebs’ own Virginia license as a free sample. The thread claimed: “We have been continuously exfiltrating new data for over a year into our private database.” SecurityWeek reported that a separate actor promoting the service on a Russian forum claimed to hold IDs for more than 170 million people.
Krebs reported that a blank search returned about 11.5 million pages of results at roughly 15 records per page. A Canada-only search returned about 1.1 million results, with Ontario the largest Canadian concentration at 473,673 records. The listed license count grew by nearly 400,000 over 24 hours during his reporting. He did not report pricing.
Shortly after publication, the Nexus login page was replaced with the message “This service is no longer available.” Whether the operation stopped or moved has not been publicly established; the hosting dynamics behind that question are examined in why bulletproof hosting takedowns keep failing.
How was the data traced to IDScan.net?
Scan timestamps and image types tied the Nexus records to IDScan.net, a Louisiana identity-verification vendor whose scanners check IDs at rental counters, retailers and cannabis dispensaries. Nine people whose licenses appeared in Nexus confirmed to Krebs that they had traveled on or near the timestamp dates, and IDScan.net markets technology that “scans IDs with both infrared and ultraviolet light.”
Krebs’ license and his mother’s carried timestamps seconds apart, matching a joint handoff at a Hertz counter. Hertz appeared on IDScan.net’s client list alongside Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment. Researcher Zach Edwards matched his record to a visit to the Planet13 dispensary in Las Vegas; a 2022 press release described an exclusive identity-verification agreement between IDScan.net and Planet13. Larry Baldwin of Cybera said his scan carried timestamps matching a Hertz rental.
Caesars told Krebs on Sept. 2 that it “has not been a client of IDScan.net and has not used VeriScan since February 2025,” and that it “did not authorize IDScan.net to retain data from its accounts.”
IDScan.net says it performs more than 21 million verifications a month at more than 20,000 locations, according to SecurityWeek.
Timeline
- April 1 or April 4, 2026: Unauthorized access to IDScan.net’s cloud environment began. The Oregon filing lists April 1; the vendor notice says April 4.
- On or about Aug. 31, 2026: Nexus was advertised on Exploit, and a source alerted KrebsOnSecurity.
- Sept. 1, 2026: Krebs published. The FBI’s New Orleans field office opened its investigation. IDScan.net says it learned of possible unauthorized access on or around this date.
- Sept. 2, 2026: Unauthorized access ended, per IDScan.net. Caesars issued its statement.
- Sept. 4, 2026: IDScan.net posted its incident notice, began notifications and informed business customer Harborside, per ID Tech.
- Sept. 7, 2026: Infosecurity Magazine reported at least four class actions against IDScan.net in the U.S. District Court for the Eastern District of Louisiana.
- Sept. 18, 2026: IDScan.net’s Oregon breach report, listing 13,000,000 affected, was recorded.
- Sept. 21, 2026: Canada’s privacy commissioner opened an investigation under PIPEDA.
- Sept. 29, 2026: IDScan.net updated its notice with the access window and VeriScan scope.
- Oct. 5, 2026: ID Tech reported Harborside’s customer notices.
- Patch and proof-of-concept: None. There is no CVE, no software fix and no public exploit code.
What did IDScan.net confirm?
IDScan.net confirmed that an unauthorized third party “gained access to a portion of our cloud environment between April 4, 2026, and September 2, 2026,” and that “the event was limited to the VeriScan platform.” The notice says the investigation is ongoing and that the company is not aware of misuse of personal information.
Depending on how each business customer used VeriScan, exposed data could include a combination of full name, contact information, date of birth, and driver’s license, passport or other government-issued ID numbers. Not every category applies to every person. The company said it secured its systems, engaged third-party specialists, is offering free credit monitoring and identity-protection services, and continues “to cooperate with applicable regulatory and law enforcement authorities.”
When Krebs first contacted the company, marketing and operations leader Jillian Kossman said: “At this point I’m not able to share any additional information.”
The notice does not identify an initial-access vector, a vulnerable component, a count of affected people, or whether the Nexus inventory came from its systems. No CVE, CWE or CVSS score has been published. This is a cloud data-exposure investigation, not a coordinated vulnerability disclosure, so there is no affected version range to patch.
How many people are affected?
IDScan.net’s breach report to Oregon lists 13,000,000 people affected, according to the state’s consumer data-breach database. The entry, reported Sept. 18, 2026, gives a discovery date of Sept. 1 and a notice date of Sept. 4. The vendor’s public notice gives no count.
Neither IDScan.net nor the FBI has publicly reconciled that figure with Nexus’ claim. Nexus advertised a record count; the Oregon filing counts affected individuals. Both the regulatory filing and the vendor notice describe an access window of about five months, shorter than the seller’s claim of more than a year of continuous exfiltration.
What does a VeriScan scan record contain?
A scan record holds more than the fields named in IDScan.net’s notice. Harborside’s customer notice, reported by ID Tech on Oct. 5, lists names, home addresses, dates of birth, sex, license or state ID numbers, issuing states, issue and expiration dates, and document control numbers. Front-of-ID images may show photographs, signatures, height, weight, and hair and eye color.
Scan records may also include the date and time, the store, the approximate GPS location of the scanning device, and VeriScan’s document-authenticity result. Harborside said not every type was involved for every customer and reported no indication that payment information or purchase history was affected. Per that notice, IDScan.net is offering 12 months of credit monitoring and identity protection. Harborside said it is reviewing its data-retention, privacy and vendor-oversight policies.
Baldwin warned Krebs that exposed scans could endanger people who need to stay hidden, including domestic-violence survivors and witness-protection participants.
Who else is investigating?
Canada’s Office of the Privacy Commissioner opened an investigation on Sept. 21, 2026. Commissioner Philippe Dufresne’s office will examine the safeguards IDScan.net had in place at the time of the breach, the adequacy of its notifications to affected individuals, and compliance with PIPEDA, Canada’s federal private-sector privacy law. The OPC said it has engaged with IDScan.net since the company’s public advisory and declined to share further details while the investigation is active.
In the U.S., the proposed class actions filed in the Eastern District of Louisiana seek damages and improvements to IDScan.net’s internal security posture, according to Infosecurity Magazine.
What defenders should do
- Within 24 hours: Determine whether any business unit, franchise or location uses VeriScan or other IDScan.net products. Check procurement records and store hardware, not only the vendor register. Request tenant-specific exposure findings from IDScan.net.
- Within 72 hours: Export and preserve VeriScan administrative, scan and export logs covering April 1 to Sept. 2, 2026. Review retention settings and purge stored ID images and scan records that no business requirement justifies. IDScan.net’s VeriScan Cloud documentation says new accounts default to collecting and retaining all records; eligible plans can collect anonymized or selected fields and automatically purge data. Classic VeriScan for Windows requires a separate review of local database settings.
- Within 7 days: Treat driver’s-license images and numbers as compromised identity evidence. Add a second verification step to account opening, account recovery and help-desk workflows that accept a license image, and flag reused document images. Detection approaches for synthetic identity fraud apply to this data set.
- Within 14 days: With counsel, assess whether the organization carries its own notification obligations to customers whose IDs it scanned through VeriScan, as Harborside did.
- Within 30 days: Amend identity-verification vendor contracts to cover logging, retention limits and incident-notification timelines, the controls NCC Group’s Tim Rawlins recommended to SecurityWeek.
FAQ
Was my driver’s license in the IDScan.net breach?
IDScan.net is notifying potentially affected people directly, and some business customers, including Harborside, are sending their own notices. Anyone who handed a license to a counter that scanned it with VeriScan between April and September 2026 may be included. The vendor’s notice directs questions to a call center at 1-833-516-2980.
Is the Nexus dark-web service still online?
Nexus went offline shortly after KrebsOnSecurity published on Sept. 1, 2026, replacing its login page with “This service is no longer available.” Whether the operator stopped selling, moved the data elsewhere or sold it privately has not been publicly established. The FBI has not announced results of its New Orleans investigation.
What should I do if my driver’s license scan was leaked?
Place a credit freeze or fraud alert under Federal Trade Commission guidance, enroll in the credit monitoring IDScan.net offers, and review statements and credit reports for accounts you did not open. Confirmed identity-theft victims can report the misuse and get a recovery plan at IdentityTheft.gov. Harborside advises contacting the issuing agency if a license number is misused. Malwarebytes also warns of phishing and account-recovery scams.
Can someone open a credit line with a stolen driver’s license scan?
A stolen scan can support that kind of fraud. KrebsOnSecurity noted that state-issued driver’s licenses are commonly used as proof of identity when opening new lines of credit. A scan pairing a photo, signature, date of birth and license number gives fraudsters material for impersonation at onboarding checks that accept document images.
Related across the network
- Dutch Police Arrest ShinyHunters Suspect; Attacks Escalate — ai-alert.org
- Deepfake Fraud Cases Explained: What 8 Incidents Show — aiincidents.org
- How to Delete Your Digital Footprint: A Realistic Guide — anonguide.com
