ID Verification Firm IDScan.net Leaked 153M Driver's Licenses in Real Time for a Year

A dark-web identity-theft service called Nexus is selling scanned driver’s licenses belonging to more than 153 million people across the US and Canada, and the trove is still growing—nearly 400,000 records were added in a single 24-hour window. Brian Krebs traced the images back to IDScan.net, a Louisiana-based identity verification provider whose clients include Hertz, FedEx, Target, and thousands of cannabis dispensaries. The attackers claim they had been quietly exfiltrating every ID the company scanned for over a year, effectively running a live feed of government IDs that no one inside the company appears to have noticed. The FBI’s New Orleans field office has opened an inquiry.

The exposure is severe precisely because driver’s licenses are a primary proof of identity for opening credit lines and passing the AI-based image-matching checks that verification systems increasingly rely on. Security researcher Larry Baldwin of Cybera warned that the leak endangers people who cannot afford to be found—domestic-violence survivors and even federal witness-protection participants—since their appearance can’t be meaningfully altered. The stakes aren’t abstract: Krebs found a scan of the sitting Secretary of Defense’s license listed for $100.

The breach undercuts the central promise of the age- and identity-verification push. IDScan.net markets its certifications, GDPR/CCPA compliance, and a still-live ‘Trust Center,’ and has publicly backed mandates like the Kids Online Safety Act—all while its pipeline leaked for a year. The episode reinforces a structural argument critics have made since the 1990s: verification inherently creates a durable record of sensitive identity data, and that record inevitably becomes a target. There is no version of mandated age or identity verification that doesn’t put people at risk.