IDScan.net Breach Exposes 153M Driver’s Licenses and IDs
IDScan.net confirms data breach revealing 153 million driver’s licenses and ID scans from September 2026.
Why it matters: The breach exposes vulnerabilities in identity verification services, posing privacy and cybersecurity risks to legal tech firms and their clients.
- IDScan.net confirmed the breach on September 1, 2026, following unauthorized cloud data access.
- A dark web marketplace called Nexus listed 153 million U.S. and Canadian ID scans for sale.
- Nine class-action lawsuits were filed September 2-4, 2026, in Louisiana’s Eastern District against IDScan.net.
- The FBI’s New Orleans field office has launched an official investigation into the breach.
IDScan.net, a New Orleans-based identity verification firm, disclosed a data breach on September 1, 2026, affecting more than 153 million identity documents. Exposed data includes U.S. and Canadian driver’s licenses, ID cards, travel documents, and medical cards collected through their verification services. BiometricUpdate reported that a dark web marketplace named Nexus listed these documents for sale.
The breached data represents a significant portion of personal information used by legal and corporate clients. Customers of IDScan.net include organizations such as Hertz, Target, FedEx, Motorola Solutions, and Jack Henry. Caesars Entertainment confirmed it ended its contract with IDScan.net in February 2025 and did not allow retention of its data post-termination. Zyphe reported that nine class-action lawsuits were filed against IDScan.net in the Eastern District of Louisiana within days after the breach announcement.
The FBI’s New Orleans field office has commenced a formal investigation into the incident. While details of the breach method remain unavailable, the exposure underscores important concerns for legal tech providers relying on identity verification services regarding data security and regulatory compliance.
By the numbers:
- 153 million — number of driver’s licenses and IDs exposed
- September 1, 2026 — breach confirmation date
- Nine — class-action lawsuits filed within three days of breach disclosure
Yes, but: Specific details on breach methods remain undisclosed, limiting full risk assessment.
What's next: Legal proceedings are ongoing in the Eastern District of Louisiana; the FBI investigation continues.