Think about the last time you rented a car, grabbed a package at FedEx, or showed ID at a dispensary. Forgettable. Routine. Except that scan may have fed into a Louisiana company called IDScan.net — and investigators now link IDScan’s systems to a dark-web marketplace called Nexus, which was selling searchable access to over 153 million U.S. and Canadian driver’s license images. The FBI’s New Orleans field office has opened a formal investigation. Your face, your address, your license number — possibly on sale.
The Registry: Brands Publicly Tied to IDScan’s Systems
These are the companies whose ID-scanning practices reportedly fed the suspected breach.
IDScan.net performs more than 21 million ID verifications per month across 20,000-plus locations. That’s the math of centralized failure. Among the brands named in Krebs’ reporting, IDScan’s own client materials, and class-action filings:
- Hertz — rental counter scans; multiple confirmed victims traced here
- FedEx — retail ID checks, listed on IDScan’s own trust page
- Caesars Entertainment and Circa Resort & Casino — listed as casino KYC and age-verification clients, though a Caesars spokesperson says the company has not used IDScan since February 2025, despite remaining on IDScan’s site
- Planet 13 — the marijuana dispensary chain held an exclusive IDScan agreement announced in 2022
- GameStop — named explicitly in class-action lawsuit filings
The US Coast Guard and Coast Guard Academy appear in community-compiled lists but aren’t yet confirmed by major investigative outlets. Treat that as unconfirmed, not established fact.
One Vendor, One Catastrophic Pool
Centralizing ID authentication in a single vendor turns routine identity checks into a single, enormous target.
Every business that outsources ID authentication to a single vendor funnels sensitive government documents into one place. Breach that once, and it’s not one company’s customers exposed — it’s everyone who ever handed their license to anyone using that system.
Cybersecurity journalist Brian Krebs confirmed the connection by searching for his own driver’s license in the Nexus database, matching infrared and ultraviolet scan signatures to IDScan’s documented imaging technology. The data was likely “siphoned from identity verification platform IDScan.net,” according to Krebs. Security researchers put it more bluntly: a surveillance app or company “which does ID verification for in-person interactions… has somehow exposed over 153,000,000 drivers licenses.”
Where Things Stand – and What Happens Next
The marketplace is down, but the data isn’t gone — and the legal fallout is just beginning.
Nexus has gone offline. The data was already widely copied before takedown — like screenshots of a deleted tweet, except the tweet is your government ID. At least four class-action lawsuits have been filed in the Eastern District of Louisiana. IDScan.net says it is “investigating” but has offered no detailed public explanation of what broke, how, or for how long.
A driver’s license image in criminal hands enables synthetic identity fraud and account takeover — not abstract harms, but opened credit lines and drained accounts. If you’ve visited any of these brands in recent years, freeze your credit now. It costs nothing. Waiting could cost you everything — learn how to stay safe from data risks in everyday situations.
Correction 8/3/2026:
Removed mentions of Target being involved. Per Target, the company was not involved in any alleged breach, and does not transmit any guest data to IDScan.
