IDScan.net data breach (2026): what was exposed and what to do

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

What happened

IDScan.net, a Louisiana-based identity verification company, confirmed that an unauthorized third party may have accessed and/or copied certain customer information stored in its cloud platform. In a notice dated September 4, 20261, the company said it received information on or around September 1, 2026 indicating unauthorized access, secured its systems, and engaged third-party specialists. IDScan said records entered before September 1, 2026 may be affected, that it found no evidence of ongoing access, and that it is cooperating with federal law enforcement.

On September 1, 2026, Krebs on Security reported that a marketplace called Nexus was advertising scans of more than 153 million U.S. and Canadian driver's licenses, plus other ID types, and linked samples to IDScan's verification workflow3. Krebs also reported that the FBI's New Orleans field office opened an investigation. The 153 million figure is a seller's claim, not a company-confirmed count of affected people.

IDScan's notice says names and driver's license or other government-issued identification numbers may have been involved. TechCrunch reported that images of licenses and passport ID numbers were also taken5; the company has not confirmed that. IDScan's tools, including VeriScan, are used by businesses such as car rental counters and age-verified retailers, so anyone who had an ID scanned at one of those businesses may be affected. Several class action lawsuits have been filed against the company6.

What data was exposed

The following types of personal data were compromised:

• Full names
• Driver's license numbers
• Other government-issued identification numbers
• ID document images and passport ID numbers (reported by the press, not confirmed by IDScan)

Breach details

This summary is compiled from public notices and reporting available when this page was last updated. Figures reflect what those sources report and may change as investigations continue. If something here looks wrong or you think your personal data is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by IDScan.net; it reflects a publicly reported security incident.

For whether your personal data was involved and for official remediation offers, rely on notices from the organization named above (or from anyone they say will contact you), not this page alone.

What to do now

Based on the data exposed in this breach, here are the steps you should take:

• Place a free credit freeze with Equifax, Experian, and TransUnion. A name plus a driver's license number is enough to attempt new-account fraud.
• Treat calls, texts, or emails that use your full name and ask you to "verify your ID," renew a license, or recover an account as possible scams. Contact the organization through a number you look up yourself.
• Review bank, credit card, and government accounts for activity you don't recognize, including attempts to open accounts with a copy of your license.
• IDScan is offering free credit monitoring and identity protection. Enroll only through its official notice or the call center listed there (1-833-516-2980, Monday to Friday, 8am to 8pm ET), not through links in unexpected messages.
• Ask your state motor vehicle agency whether it will issue a replacement license with a new number after an ID-document exposure, and keep a copy of any breach notice you receive.

What should I do if a business scanned my ID using IDScan?

Freeze your credit at all three bureaus, since a name and licence number are enough to attempt new-account fraud. Treat any call or message asking you to "verify your ID" as a possible scam, and enrol in the monitoring IDScan offers only through its official notice.

Frequently asked questions

Does this mean my driver’s licence is for sale?

Not necessarily. A marketplace advertised more than 153 million licence scans and IDScan confirmed unauthorised access to customer data in its cloud platform, but the seller’s figure is a claim, not a confirmed victim count, and no source can tell you whether your licence is in that set.

Can I get a new driver’s licence number?

Some state agencies will reissue a licence with a new number after an identity-document exposure. Ask your motor vehicle agency directly, and keep any breach notice you receive in case they ask for evidence.

Can Delist remove my licence from the leaked data?

No. Nobody can retrieve a file from a criminal marketplace or an ID vendor’s systems. What we remove is the open-web listings that publish your name, address, phone number and relatives.