What to do

The IDScan.net breach: what to do if your driver's license scan was stolen

Updated 19 September 2026

If you have handed your driver's license to a rental car desk, a store or a dispensary that scanned it in the past year or so, it may be part of the IDScan.net breach. The Louisiana ID verification company confirmed on September 4, 2026 that an unauthorized party may have accessed and copied customer data including full names and driver's license or other government ID numbers, after a dark web service offered scans of more than 153 million licenses. The fix is the same one you would use after any ID leak: a free credit freeze at all three bureaus, a call to your DMV, and a close eye on anyone who contacts you about the breach.

What happened at IDScan.net

The story broke on September 1. Brian Krebs reported that a new identity theft service called Nexus, advertised on a Russian-language cybercrime forum from August 31, was selling scans of more than 153 million driver's licenses from the US and Canada, plus more than 10 million ID cards, more than three million travel documents and at least 579,000 medical cards. The seller claimed the images came from an active breach at "a major identity verification company" and said they had been taking data for over a year.

Krebs found his own license in it, then asked friends and family for permission to search for theirs. Many records carried a timestamp, and the nine people whose licenses turned up confirmed they had traveled on or near those dates. Several had handed their license to a Hertz rental counter that day. A researcher whose license was also listed traced his timestamp to a cannabis dispensary in Las Vegas. Both businesses had one thing in common: IDScan.net, a company based in the New Orleans area whose scanners and software check IDs for rental firms, retailers, casinos, bars and more than 1,000 dispensaries.

The same day, the FBI's New Orleans field office opened an investigation. Within hours of the story going up, the Nexus site replaced its login page with a message saying the service was no longer available. That does not mean the data is gone. Whoever took it still has it.

On September 4, IDScan.net posted a notification of data security incident. It says the company learned of possible unauthorized access on or around September 1, that "an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud," and that the data may include full names and driver's license or other government-issued identification numbers. It is notifying people who may be affected and offering free credit monitoring and identity protection.

Key facts and dates

• August 31, 2026: Nexus appears on a cybercrime forum, claiming 153 million+ license scans.
• September 1: KrebsOnSecurity links the records to IDScan.net. The FBI's New Orleans office opens an investigation. Nexus goes offline that evening.
• September 4: IDScan.net posts its breach notice and a call center number, 1-833-516-2980, open Monday to Friday, 8am to 8pm Eastern.
• By September 10: PCMag reported more than a dozen class action lawsuits filed against the company, and named Hertz, FedEx and GameStop among its clients.
• What was in the records: front and back images of the license, a plain scan, and infrared and ultraviolet versions of the same images, with a date and time on each file. Not every record had a photo.

Was my license in it?

You probably cannot know for certain yet, and nobody selling a lookup can tell you either. What you can do is think about where your ID was scanned rather than glanced at.

The records Krebs examined point to moments when a license went into a machine at a business counter: a rental car desk, a dispensary door. IDScan.net's own site says its systems run more than 21 million verifications a month at more than 20,000 locations, and it has listed clients including Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment. Caesars told Krebs it had not used the company's VeriScan product since February 2025. Being a customer of a listed brand does not mean your license was taken, and the reverse is also true: plenty of smaller bars, shops and venues use ID scanners without naming the vendor.

So treat these as signs you should act now rather than wait for a letter:

• You rented a car from Hertz since mid-2025, the period the timestamps Krebs checked fall in.
• You showed ID at a cannabis dispensary that scanned it.
• A store, casino, bar or office lobby put your license into a scanner or photographed it with a tablet.
• You get a notice letter or email from IDScan.net or from a business that used it.

If none of that fits, the freeze below is still worth fifteen minutes. Licenses leak in other breaches too, and it protects you from all of them at once.

What can someone do with a stolen license scan?

More than with a license number alone. A clean image of the front and back, with your photo, date of birth, address and license number on it, is exactly what a thief needs to pass the identity step of many applications. Larry Baldwin, a researcher at the security firm Cybera, told Krebs that state-issued licenses are commonly used as proof of identity when opening new lines of credit. The IdentityTheft.gov checklist makes the same point more plainly: "An identity thief could try to impersonate you using your driver's license information."

In practice that means a few things to watch for:

• New accounts in your name. Credit cards, loans, phone lines, buy now pay later accounts. The license gets the thief past the identity check; your credit file decides whether they are approved. That is why the freeze matters most.
• Account takeovers. Some online services ask for a photo of your license to verify you or to recover a locked account. A stolen scan can be used to try the same thing.
• Convincing scam calls. A caller who can read out your license number and home address sounds official. That trick is the backbone of the fake jury duty and warrant calls the FBI warned about this month. Knowing your details does not make a caller real.
• Being found. The license shows your home address at the time it was scanned. For people fleeing an abuser or a stalker, Baldwin told Krebs, that is the most serious risk of all.

What a license scan does not give anyone is your Social Security number, your bank password or access to your existing accounts. IDScan.net's notice does not say Social Security numbers were involved. If you have separately given out your SSN, follow our page on what to do after giving out your Social Security number as well.

What to do this week

These steps come from the federal IdentityTheft.gov data breach checklist, in the order that does the most good.

1. Freeze your credit at all three bureaus. It is free to place and free to lift. While it is in place, nobody can open a new credit account in your name, license or not. Experian is at 888-397-3742, TransUnion at 888-909-8872 and Equifax at 800-685-1111, or do it online. Our step-by-step credit freeze guide covers the verification quiz that trips people up.
2. Tell your DMV. IdentityTheft.gov says to contact your nearest DMV branch (find it at usa.gov/state-motor-vehicle-services). Your state might flag your license number in case someone else tries to use it, or suggest you apply for a duplicate. Ask which one they recommend and what it costs.
3. Accept the free monitoring, carefully. IdentityTheft.gov says to accept free credit monitoring when a company offers it. Enroll only through the phone number or code in a letter you can match against IDScan.net's own notice page, which lists 1-833-516-2980. Monitoring tells you after something happens. The freeze stops it happening.
4. Read your credit reports. You can pull all three every week, free, at AnnualCreditReport.com. Look for accounts, addresses and hard inquiries you do not recognize. Once now, then every couple of months for the next year.
5. If a freeze is too much today, place a fraud alert. One call to any one bureau sets a free alert for a year, and that bureau tells the other two. It asks lenders to verify it is really you. It is weaker than a freeze, but it is better than nothing tonight.
6. Tighten account recovery. Put a PIN or passcode on your mobile phone account, and turn on app-based two-factor sign-in for your email and bank, so a license upload alone cannot take them over.

If you find an account you did not open, report it at IdentityTheft.gov, which builds a recovery plan and dispute letters for you. Our page on where to report a scam lists the other agencies and what each one handles.

Watch for the scams that follow a breach

A breach that makes headlines is a gift to scammers, because millions of people are now expecting a call or an email about it. Some patterns to expect over the coming months:

• Fake notice emails and texts with a link to "check if you were affected" or "claim your monitoring". The real enrollment runs through the letter and the call center. A link in a text is not how this works.
• Callers who "verify" you. Someone claiming to be from IDScan.net, Hertz, your bank's fraud team or a law firm asks you to confirm your license number, Social Security number or a code sent to your phone. Hang up and call back on a number you find yourself. The same trick powers the fake bank fraud alert text.
• Settlement bait. With class actions filed, genuine settlement notices may arrive one day, typically by mail and never asking for a fee to join. Anyone who wants money up front to put you in a lawsuit is running a scam.
• Paid "dark web removal". Nobody can delete your license from a criminal's copy. Services promising to scrub it are selling reassurance.

If you already paid one of these callers or handed over account details, go straight to I paid a scammer: what now. Speed matters more than anything else there.

Should you let businesses scan your license?

Often you have no real choice. A rental company needs to see a valid license, and many states require age checks at the door. But there is a difference between someone looking at your license and a machine storing images of it in a vendor's cloud, and it is fair to ask which one is happening.

Ask whether they need to scan it or can just check it. At a bar or a shop, a visual check is often enough. Where ID is optional, such as some office lobbies and loyalty sign-ups, you can decline. For travel, a passport card or passport at the airport means one fewer place your license is scanned, which is how Krebs worked out that his own leaked scan came from the rental counter. None of this undoes a breach that has already happened, and cutting down on data brokers who publish your address is a separate job, covered in removing your address from the internet.

How worried should you be?

Worried enough to spend an afternoon on it, not enough to lose sleep. A stolen license scan is serious because you cannot easily change the face, birth date and address on it, and it makes fake applications more convincing. But the harm almost always runs through one of two doors: new credit in your name, or a scammer who uses your details to get you to act. A freeze at all three bureaus closes the first door. Hanging up on anyone who calls about the breach, and calling back on a number you found, closes the second. Do those two things this week and you have covered most of the risk this breach created.