LOUISIANA — IDScan acknowledged a data security incident on September 4, 2026, after cybercriminals accessed its cloud platform and exposed an estimated 153 million identity documents. The Louisiana-based company provides in-person identity and age verification services for corporations including Hertz, FedEx, GameStop, and Target.

Independent cybersecurity journalist Brian Krebs reported the breach after being alerted to a Russian-language cybercrime forum and dark web marketplace known as 'Nexus.' Krebs verified the authenticity of the leaked data by locating his own scanned driver's license on the dark web service. The Nexus operators claimed to have exfiltrated sensitive data into a private database for over a year.

The dataset includes driver's licenses primarily belonging to U.S. residents. The records also include roughly 1.1 million Canadians. The exposed documents include 10 million ID cards, 3 million travel documents, and over 579,000 medical cards. IDScan reported processing 150 million ID scans in 2025.

Cybercriminals claimed to have stolen 160 million IDs from IDScan. That figure represents a rise from 150 million to 160 million, or 6.7%. IDScan stated that full access to the information on the dark web required payment.

The leaked database contained the driver's license of U.S. Secretary of Defense Pete Hegseth. The Pentagon stated it was aware of the suspected IDScan breach. IDScan serves more than 1,000 cannabis dispensaries, car rental agencies, and gun shops across 19 states.

IDScan is cooperating with federal law enforcement, including the FBI. An FBI spokesperson confirmed the agency is investigating the IDScan breach. IDScan is notifying potentially impacted individuals and providing access to free credit monitoring and identity protection services.

Why It Matters

The breach exposed an estimated 153 million personal identity documents, affecting a vast number of U.S. residents and over a million Canadians. The scale of the exposure includes sensitive government-issued identification numbers and high-resolution images used for verification, raising concerns about potential identity fraud.

IDScan provides critical infrastructure for age and identity verification across major retail, rental, and regulated industries. The involvement of federal law enforcement and the confirmation of data authenticity by independent journalists underscore the severity of the incident and the broad impact on consumers and corporate partners.

Timeline

In 2025, IDScan reported processing 150 million ID scans. On or around September 1, 2026, IDScan stated that it received information indicating that certain data may have been accessed without authorization, and it took immediate steps to secure its systems and engaged a team of third-party specialists to determine the full nature and scope of the incident. IDScan stated it received information on or around September 1, 2026, indicating an unauthorized third party may have accessed or copied customer information. IDScan acknowledged a data security incident on September 4, 2026.

What's New

Additional details confirmed that IDScan provides identity verification technology for Target. Help Net Security reported that IDScan stated that it received information on or around September 1, 2026, indicating that certain data may have been accessed without authorization, and it took immediate steps to secure its systems and engaged a team of third-party specialists to determine the full nature and scope of the incident. TechCrunch reported that the data at risk includes names and driver’s license or other government-issued identification numbers, and the breach involved the theft of driver’s licenses from IDScan’s systems, with the stolen information including people’s full names and driver’s license numbers, along with identity numbers from other government-issued documents, such as passports.