IDScan.net

A dark web identity theft service called Nexus began selling scanned government IDs. Reporting traced the images to IDScan.net, a vendor whose software checks licenses at bars, car rental counters, dispensaries and age-restricted retail. The seller advertised more than 153 million driver's licenses from the United States and Canada, plus millions of passports, medical cards and insurance cards.

IDScan.net said that on or around September 1, 2026 it received information indicating certain data may have been accessed without authorization. That is a narrower statement than the seller's advertisement. The 153 million figure is the marketplace's claim, not a company-confirmed count, and the two should not be read as the same fact. The FBI confirmed it is investigating. Nexus went offline shortly after the reporting published.

Not fields in a database. Photographs. The front and the back of each license, plus infrared and ultraviolet captures of the same card. Those alternate exposures exist because that is how a scanner proves a license is genuine. They are the anti-counterfeiting layer, and they were reportedly taken along with everything else.

Inside the images: full names, dates of birth, home addresses, license numbers, issue and expiry dates, height, eye color, signature and photograph. The collection also reportedly included passports, medical cards and insurance cards. A driver's license number is not resettable. Neither is a face.

Almost nobody in this dataset chose IDScan.net. They handed a license to a doorman, a rental clerk or a checkout screen and watched it get scanned. The relationship was with the bar, not the vendor behind the glass.

A high-resolution scan of both sides of a real license is the raw material for account takeover at any institution that accepts a photographed ID for verification. Banks do. Crypto exchanges do. Mobile carriers do. The infrared and ultraviolet captures make a forgery harder to detect, because they satisfy the second check that normally catches a flat copy. For anyone in the set, the remedy is a new license number, which most states will not issue simply because a scan leaked.

Verifying identity is a security function. A vendor doing it at scale sits in the trusted position by design, and its customers buy it precisely so they do not have to handle ID documents themselves. Scanning, checking and returning a pass or fail is the product working as sold.

The gap is between checking an ID and keeping it. A verification decision needs the image for seconds. A retention policy, a compliance requirement or a model training pipeline can keep it for years. Reporting has not established which of those applied here, or for how long. That question is the difference between a transient buffer and a 153 million image archive.

The company's first public statement said data may have been accessed. Not which data. Not how much. Not whose. That phrasing is what an organization says when the intrusion is established before the inventory is.

Image archives are the hardest category to account for, because the sensitive content is pixels rather than text. A database of license numbers can be queried. A bucket of several hundred million JPEGs cannot answer "how many of these contain a Canadian passport" without something reading every file. Counting objects is cheap. Knowing what is inside them is the part that has to have been done in advance, because after a seller posts a sample there is no time left to start.

The distance between the company's careful sentence and the seller's confident number is the measure of that gap. One side had to be precise. The other did not.

No group claimed this one. There was no leak site countdown and no ransom note in the public record. The data simply appeared for sale on a marketplace built to monetize it, which is a colder signal than extortion. An extortionist wants the victim to know. A seller does not care.

Nexus shutting down after publication removes the storefront, not the copies. Buyers who acquired records before the takedown still hold them, and the FBI investigation will take months to say anything public. Attribution here is a longer question than usual, and notification duties do not wait for it.

Deleting the images after the verification decision. The check needs the scan for a moment. Almost nothing downstream needs the scan at all, and a pass or fail result with a timestamp carries the audit value without carrying the liability.

Failing that, knowing the contents of the archive before anyone else did. An organization that can state, on the day, how many passports and how many medical cards sat in which storage location is negotiating from evidence. An organization that says data may have been accessed is waiting for a criminal marketplace to publish its inventory for it. Both statements were made this month. Only one of them was made by the company that owned the data.