# 153 million drivers licence scans are for sale on the dark web right now

> IDScan, the identity verification vendor used by Hertz, Target and FedEx, lost 153 million scanned drivers licences to hackers who had access for over a year.

- Published: 2026-09-12
- Topic: [Security](https://futuretechnologyhq.com/topic/security/)
- URL: https://futuretechnologyhq.com/article/idscan-data-breach-153-million-drivers-licences/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- 153 million US and Canadian drivers licence scans are listed for sale on a dark web marketplace called Nexus
- IDScan processes identity checks for Hertz, Target, FedEx, Motorola and cannabis dispensaries
- The breach went undetected for over a year, with nearly 400,000 new records exfiltrated in a single day
- Unlike passwords, a scanned drivers licence cannot be reset or rotated

## Article

153 million. That is the number of scanned US and Canadian drivers licences now listed for sale on a dark web marketplace called Nexus, according to security journalist Brian Krebs, who first reported the breach on 11 September.

The source is IDScan, a Louisiana-based identity verification company. Its client list includes Hertz, Target, FedEx, Motorola, and Jack Henry. If you have rented a car or bought age-restricted products at a major retailer in the past few years, your scan may be in this set.

## What the dataset contains

Each record is a full scan of a physical drivers licence: photo, full name, date of birth, home address, and licence number. The seller also claims to have 10 million ID cards, 3 million travel documents, and 579,000 medical cards from the same breach.

The seller told Krebs the data had been continuously exfiltrating for over a year. In one 24-hour window, the count grew by nearly 400,000 records, which tells you the volume flowing through IDScan's systems on a normal day. The FBI's New Orleans field office has opened an investigation.

## Why this is not like a password breach

Most data breaches give you something you can change. A stolen password gets rotated. A leaked credit card number gets replaced. A drivers licence scan cannot be reset. Your face, your date of birth, and your licence number are fixed identifiers, and a high-resolution scan is enough to pass many identity verification checks that rely on matching a photo to a document.

That combination is the building block for synthetic identity fraud, SIM swaps, and account takeovers at scale. An attacker with your licence scan and a few public data points can open accounts, redirect mail, and port your phone number, all without needing your password. For more on how attackers use initial access to escalate, see our explainer on [privilege escalation attacks](https://futuretechnologyhq.com/article/what-is-privilege-escalation-attack/).

## What you can do

There is no way to check directly whether your data is in this set until IDScan or the FBI release more details. But a few steps reduce your exposure now.

Freeze your credit with all three bureaus. It is free and prevents anyone from opening accounts in your name. Enable multi-factor authentication on every financial account, ideally with a hardware security key like the [YubiKey 5 NFC](https://www.amazon.co.uk/dp/B07HBD71HL?tag=futuretech0d6-21) rather than SMS codes, which are vulnerable to SIM swaps. Set up transaction alerts with your bank so you catch unfamiliar activity early.

Our guide to [how vishing attacks work](https://futuretechnologyhq.com/article/what-is-vishing-how-to-prevent/) is also worth reading, since stolen identity documents make phone-based social engineering significantly more convincing.

## The quiet part

IDScan is not a household name. Most people whose licences were scanned at a Hertz counter or a Target checkout had no idea a third-party vendor was storing those scans, let alone that the vendor had been leaking data for over a year without detecting it.

The FBI investigation will determine the specifics, but the pattern is familiar: a company handling sensitive biometric data at massive scale, with a breach window measured in months. The question for everyone else is how many similar verification vendors are sitting on the same kind of data with the same level of oversight.

Some links in this article are affiliate links. We may earn a small commission at no extra cost to you.

## Key takeaways

- The dark web marketplace Nexus has 153 million scanned US and Canadian drivers licences for sale, according to security journalist Brian Krebs.
- The source of the breach is IDScan, a Louisiana-based identity verification company that has scanned licences for clients including Hertz, Target, and FedEx.
- Each record contains a full scan of a physical drivers licence, including photo, full name, date of birth, home address, and licence number.
- The breach is significant because drivers licence scans cannot be reset, making them a valuable tool for identity thieves.
- The FBI's New Orleans field office has opened an investigation into the breach, and users are advised to freeze their credit and enable multi-factor authentication.

## Sources

- [HelpNetSecurity](https://www.helpnetsecurity.com/2026/09/11/idscan-net-data-breach-153-million-drivers-licenses/)
- [Malwarebytes](https://www.malwarebytes.com/blog/news/2026/09/dark-web-site-puts-153-million-drivers-licenses-and-millions-more-ids-up-for-sale)