The FBI is investigating an alleged data breach that has put millions of Americans’ driver’s licenses and other identification documents up for sale on the dark web
Independent cybersecurity journalist Brian Krebs first reported the massive breach last Tuesday (Sept. 1). According to the post on his website, digital scans of more than 153 million driver’s licenses from the United States and Canada had been listed for sale by a new user on the Russian cybercrime forum Exploit.
Krebs wrote that the user was offering paid access to digital scans of identity documents from more than 170 million people in North America on a service called Nexus, and showed a Minnesota driver’s license issued to U.S. Defense Secretary Pete Hegseth as an example.
Krebs also found his own license scan —
Krebs also found his own license scan — as well as those of some relatives and friends — with a common thread being their IDs had recently been scanned by businesses who used scanning equipment linked to the New Orleans-based ID verification firm IDScan.net, a company headquartered at 2045 Lakeshore Dr.
“The FBI can confirm that it is looking into the incident. Due to the ongoing nature of the investigation, we decline to comment further,” a spokesperson for the FBI New Orleans field office told Fox 8 on Sunday.
IDScan.net issued a statement Friday saying that after Krebs’ report, it took “immediate steps” to secure its systems and “engaged a team of third-party specialists to help determine the full nature and scope of the incident.” The company also said it was “cooperating with federal law enforcement” on an investigation.
The company’s website says it prevents ID fraud
The company’s website says it prevents ID fraud at scale, scanning “hundreds of millions” of identity documents to “catch fake IDs and synthetic identities that other systems miss.”
It lists car rental companies, casinos, marijuana dispensaries, lending companies and retailers such as Target, FedEx and Motorola among its clients.
“While the investigation is ongoing, IDScan.net has determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud,” the company wrote in a statement on its website. “The types of information contained within the affected data may include full names and driver’s license or other government-issued identification numbers.
Though full access to the information required payment,
“Though full access to the information required payment, in an abundance of caution, we are notifying potentially impacted individuals of this incident and providing access to free credit monitoring and identity protection services. If you have questions about this incident or would like to enroll in the credit monitoring and identity protection services, please call 1-833-516-2980. … You may also write to us at 8814 Veterans Memorial Blvd, Suite 3-124, Metairie, LA 70003.”
See a spelling or grammar error in our story?Click Hereto report it. Please include the headline.
Copyright 2026 WVUE. All rights reserved.
