If you’ve used your driver’s license to verify your information either in the real world or online, there’s a chance that some of your driver’s license information was stolen by hackers in a security breach against the ID verification giant IDScan that was reportedly active for a year.
“On or around Sept. 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization,” IDScan said in a statement on Sept. 4. “Upon this discovery, we took immediate steps to secure our systems and engaged a team of third-party specialists to help determine the full nature and scope of the incident.”
The hack is discussed in more detail by Brian Krebs, a security researcher who runs the website Krebs on Security. He says he was first made aware of the breach after a source alerted him to a post on a Russian cybercrime forum from a hacker offering digital scans of identity documents for more than 170 million people from a service called Nexus.
Krebs was able to access Nexus and verify that it did indeed have the documents it said it had, including a scan of his own driver’s license.
The data includes 153 million driver’s licenses, 10 million ID cards, 3 million travel documents like passports and, according to Krebs, “at least 579,000” medical cards. Most of these records are for US residents, but about 1.1 million Canadian driver’s licenses were also found.
Per IDScan, hackers weren’t able to get every piece of information from those documents, but most likely obtained full names, driver’s license numbers and government-issued ID numbers.
The hackers who ran Nexus boasted that they had obtained the information by “continuously exfiltrating new data for over a year” into a private database from “a major identity verification company.”
The data collected likely came from a range of sources. Krebs says the leak of his information could have resulted from renting a car from Hertz, which uses IDScan to verify driver’s licenses. Other companies named on IDScan’s website as customers included FedEx, GameStop and over 1,000 cannabis dispensaries, car rental agencies and gun shops across 19 states. A screenshot of IDScan’s website also included Target as a customer, and a representative for Target told CNET that while the retailer uses some of IDScan’s hardware, it did not transmit customer data to IDScan and Target customer data was not included in a data breach. IDScan reported that it scanned 150 million IDs in 2024 alone.
The New Orleans field office of the FBI is investigating the matter. The FBI has not responded to a request for comment.
Here’s what you can do
IDScan says it will notify everyone who was affected by the breach and “provide access to free credit monitoring and identity protection services” for those people. If you end up being one of them, IDScan says to contact it at 1-833-516-2980 (Monday-Friday, 8 a.m. to 8 p.m. ET) to enroll in those services.
Those concerned they may have been affected have a few options. The easiest and quickest is a credit freeze, which makes it much more difficult for cybercriminals to open new accounts in your name. CNET has a guide for that if you need help. Freezing your credit is free, but it requires you to set up individual accounts with the three major credit bureaus.
Since cybercrime can strike anywhere and at any time, it’s also good to follow some tips to keep yourself safe, including using strong passwords, familiarizing yourself with the latest AI-powered phishing scams and considering using a VPN to help obfuscate your online presence so you can’t be tracked.
The unfortunate reality is that cybersecurity breaches are getting bigger, and companies are telling consumers less about what’s happening, so it’s worth staying vigilant, even if your driver’s license wasn’t stolen.
See full bio