IDScan.net is a cloud-based identity-verification platform that businesses use to confirm age, identity, and compliance status. The company disclosed a data security incident in which an unauthorized third party may have accessed and copied customer information stored in its cloud environment.
Affected data may have included full names and driver’s license or other government-issued identification numbers. IDScan.net disclosed the incident at idscan.net/notification-data-security-incident/.
What Happened
The company says it learned of the potential unauthorized access on or around September 1, 2026, and has since engaged federal law enforcement.
IDScan.net says it received information on or around September 1, 2026, suggesting some data may have been accessed without authorization. The company says it is cooperating with federal law enforcement and that its investigation remains ongoing.
“While the investigation is ongoing, IDScan.net has determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud.” , IDScan.net, public incident notice.
The Dark Web Dimension
Separate investigative reporting linked the incident timing to a dark web marketplace selling a massive trove of driver’s license scans, though IDScan.net has not confirmed that connection.
Separately, journalist Brian Krebs reported on September 1 that a dark web marketplace called Nexus was selling driver’s license scans. The listing reportedly included more than 153 million U.S. and Canadian records.
Reporting from KrebsOnSecurity and TechCrunch suggested a likely connection between that trove and IDScan.net data. IDScan.net has not publicly confirmed the Nexus marketplace as the source.
That link remains an externally reported allegation with strong inferential support, not a confirmed official attribution. The timing of IDScan.net’s incident notice and the Nexus listing leaves the relationship open and unattributed, despite an ongoing FBI investigation.
“Though full access to the information required payment, in an abundance of caution, we are notifying potentially impacted individuals of this incident and providing access to free credit monitoring and identity protection services.” , IDScan.net, public incident notice.
Why This Exposure Carries Higher Risk
Government-issued ID scans are not like a compromised email password or a leaked credit card number you can cancel and replace. A driver’s license number paired with your full name can fuel account fraud, synthetic identity creation, and impersonation across verification systems that treat these credentials as definitive proof of identity.
Because driver’s licenses are persistent credentials, the exposure does not expire when the breach is contained. The damage potential stretches forward in time. Similar risks have emerged from files exposed through cloud storage vulnerabilities at other major platforms.
What You Should Do Now
Taking a few steps now can limit your exposure, even if you are not yet sure whether your information was affected.
Accept the free credit monitoring and identity protection services IDScan.net is offering. Then place a fraud alert or credit freeze with the three major bureaus: Equifax, Experian, and TransUnion.
Watch for phishing attempts or suspicious account activity that references your personal details. A credit freeze costs nothing and stops most new-account fraud before it starts. Reviewing broader personal-security habits can help you stay safe against emerging threats.
The Bigger Picture
A single vendor’s compromised archive becoming a potential source for 153 million records on a dark web marketplace is not a contained corporate problem. Any business collecting and storing identity documents at scale carries risk that reaches far beyond its own customers.
Regulatory and legal scrutiny of identity-verification vendors is likely to intensify. The rise of tools like a surveillance app built to target individuals shows how collected data can be weaponized, and given the scale of what is alleged here, that pressure is overdue.
