Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached the service and offered to sell more than 153 million driver’s licenses.
Several law firms, including Markovits, Stock & DeMarco, and Hall Attorneys, have also launched investigations into potential class-action litigation related to the reported security incident at IDScan.
Brian Krebs originally reported on September 1 that a dark-web identity-theft service called “Nexus” advertised access to more than 153 million U.S. and Canadian driver’s license scans, 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
Krebs verified the samples by searching the database for his own records and those of other individuals who had consented to the checks, and tracked the leak to IDScan.
IDScan is an identity verification technology company that provides hardware and software solutions for businesses to scan, authenticate, and extract information from government-issued identity documents.
Its systems are used across the U.S. in car rental firms, retailers, gun shops, financial institutions, cannabis dispensaries, and hospitality establishments.
The company has not published any statements about these allegations, and it did not respond to BleepingComputer’s requests for comments.
Currently, it is unclear if IDScan’s systems were compromised or the number of impacted individuals.
Krebs also reported that the FBI’s New Orleans office has launched an investigation into the incident, which Reuters also confirmed independently.
The agency has also confirmed for BleepingComputer that it is looking into the incident. However, the FBI declined any further comment due to the ongoing nature of the investigation.
The illegal service Nexus is no longer online. However, cybercriminals still have access to the database.
BleepingComputer learned that the service included documents belonging to U.S. Secretary of Defense Pete Hegseth and an assistant director of the FBI, but we could not verify the information.
The lawsuits were filed in Louisiana, where IDScan is based, and allege that IDScan failed to protect information from its clients, such as global car rental company Hertz.
According to Markovits, Stock & DeMarco, IDScan has started to notify some business customers around September 1st.
The law firm says people whose IDs were scanned through businesses using IDScan’s systems may be affected, and is seeking potential claimants for a possible class-action case.
Given the incident’s potential scale, additional lawsuits—including potential class actions—could be filed, and related cases could eventually be consolidated into multidistrict litigation.
State attorneys general and federal regulators could launch separate investigations or enforcement actions, as it has happened with similar-scale data exposures in the recent past, including for 23andMe, Marriott, and Equifax.
Update [September 4, 14:50 EST]: Article edited to include FBI’s confirmation that the incident is being investigated.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
French hospital fined €500,000 after breach exposes data of 727,000
FulcrumSec claims Manchester Airports hack, theft of 86 GB of data
ExfilSquad hackers leak info of over 100,000 UK police officers, staff
Coca-Cola confirms data theft in Fairlife ransomware attack
DentaQuest data breach exposed info of 2.6 million accounts
New CrowdStrike ‘FalconFlank’ zero-day grants SYSTEM privileges
Google warns of new Chrome zero-day flaw exploited in attacks
Exchange Online outage causes email delays, ‘Server busy’ errors
Can you trust every session? See how session enrichment enables better authentication decisions.
Unify ransomware protection and recovery for every client
See how attackers exploit passkey enrollment, and why hardware-bound biometrics raise enterprise identity assurance.
Identity, Data Governance & Threat Detection in One Platform: Take our In-Browser Tour
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
