IDScan Breach 2026: 150M Licenses Stolen, Stay Safe

Over 153 million US and Canadian driver's licenses were advertised for sale on the dark web after the IDScan breach. (Image: TechPulse USA)

Published September 18, 2026 · By TechPulse USA

153 million driver's licenses were for sale on the dark web

Read that number again: 153 million. That's roughly half the driving population of the United States — names, faces, license numbers, all searchable and for sale. ID verification company IDScan confirmed on September 10, 2026, that hackers stole driver's licenses from its cloud systems, ending more than a week of silence after the breach was first exposed by cybersecurity journalist Brian Krebs.

Krebs had discovered a dark-web site called "Nexus" advertising searchable access to more than 153 million US and Canadian driver's license scans — including photos. He verified the data was authentic by finding his own record in the database. Even Secretary of Defense Pete Hegseth's license appeared among the listings. The stolen data includes full names, driver's license numbers, and ID numbers from other government documents such as passports. The FBI is investigating.

How a journalist found his own license — and the Pentagon chief's

The story broke the way the best security stories do: someone went looking. Krebs was alerted to the Nexus site, searched it, and found his own driver's license staring back at him — photo included. A security researcher who assisted the investigation found his own record too, confirming this wasn't a scam database of fabricated entries. It was the real thing, and it was queryable by anyone willing to pay.

The presence of high-profile individuals — including the sitting Secretary of Defense — tells you everything about the database's authenticity and its danger. This wasn't a targeted hack of a single organization. It was a dragnet: whoever handed an ID to a business using IDScan's scanners got swept up. IDScan, a Louisiana-based firm whose ID-checking technology is used everywhere from bars and dispensaries to car-rental counters and banks, said it learned of the unauthorized access on or around September 1 and is now offering free credit monitoring to potentially affected people. The company has not said how many people were affected.

You never heard of IDScan. It has heard of you.

Here's the part that should unsettle every American driver: you may never have heard of IDScan — it works behind the scenes. But if you've ever handed your driver's license to a business that scans IDs — a bar, a hotel, a bank, a dispensary, a rental agency — your data may have passed through its systems. You never consented to IDScan holding your identity documents. You consented to buying a beer.

And unlike a password, you can't easily change a driver's license number. A breached password gets reset in minutes. A breached government ID number follows you for years, usable for identity theft, synthetic-identity fraud, and scams that exploit the fact that criminals now hold your name, your face, and your official numbers together. This is why security experts rank ID-document breaches among the worst kind: the data doesn't expire.

5 things every US driver should do right now

Don't panic — act. These steps are ordered by impact:

• 1. Freeze your credit with Equifax, Experian, and TransUnion. It's free, takes minutes online, and is the single strongest defense against new-account fraud opened in your name.
• 2. Watch for phishing like a hawk. Scammers now hold your name, photo, and license number. Treat unexpected texts, calls, or emails asking for personal info as hostile — even ones that "prove" they know you by quoting real details.
• 3. Take IDScan's free monitoring if you receive a notification letter, and consider a broader identity-theft protection service for ongoing alerts.
• 4. Check your driving record with your state's DMV for unfamiliar tickets, violations, or address changes you didn't make.
• 5. File reports if you spot misuse — a police report plus an FTC report at IdentityTheft.gov. You'll need the paper trail for disputes.

For more on protecting yourself digitally, see our guide to the best AI tools for small business, including security picks worth knowing about.

The honest verdict

The IDScan breach is a case study in how the modern identity economy fails ordinary people: a company you never heard of, holding documents you never agreed to give it, losing them to criminals who sell them by the hundred million. IDScan's free credit monitoring is the least it can do — but monitoring only tells you after the fraud happens. The freeze, the vigilance, the DMV check: that's on you now. Stay alert for years, not weeks, because unlike a password, this data doesn't expire.

FAQ

How many licenses were stolen in the IDScan breach?
Over 153 million US and Canadian driver's license scans were advertised on the dark web, per Krebs on Security. IDScan has not confirmed a total number of affected people.

Is the FBI investigating?
Yes — the FBI confirmed it is looking into the incident.

What should I do if my license was exposed?
Freeze your credit with all three bureaus, watch for scams using your personal details, check your DMV record, and use the free monitoring IDScan is offering.

How did the breach become public?
Cybersecurity journalist Brian Krebs discovered the dark-web "Nexus" site on or around September 1, verified his own record in it, and traced the data to IDScan. The company confirmed the breach on September 10.

Sources: TechCrunch, BleepingComputer, USA Today. Published September 18, 2026.