AI-generated illustration by CyberShitty. Not a photograph or a document from the organisations named.
The ID-verification firm says names and licence numbers may have been copied from its cloud. KrebsOnSecurity linked it to a criminal service selling 153M+ licence scans.
What happened
On 1 September 2026, KrebsOnSecurity reported that a new criminal service was selling scans of what it claimed were more than 153 million driver's licences from the United States and Canada. By matching timestamps on the scans with the travel records of people who agreed to help, Krebs traced the images to ID checks at car-rental counters and cannabis dispensaries, and to IDScan.net, a Louisiana-based ID-verification company. Krebs reported that the FBI's New Orleans field office opened an investigation the same day. The sales site went offline hours after the story ran.
Confirmed vs. claimed
Confirmed by IDScan.net: in a notice on its website, the company says it learned on or around 1 September that data may have been accessed without authorisation, and that an unauthorised third party may have accessed or copied customer information stored in client accounts on the IDScan.net cloud, including full names and driver's licence or other government ID numbers. It says it is notifying people, offering free credit monitoring and cooperating with federal law enforcement.
Claimed / not confirmed: the 153 million figure comes from the sellers; IDScan.net has not said how many people are affected or confirmed that its data was the source of every record. One brand listed as a client, Caesars Entertainment, told Krebs it had not used the product since February 2025.
Who is affected
People whose ID was scanned by a business using IDScan.net, which says it runs more than 21 million verifications a month. Krebs found records from both the US and Canada. Indian travellers who showed a licence or other ID to rent a car or at a counter using this system in North America could be included.
What to do
- If you get a letter from IDScan.net, enrol in the free credit monitoring it offers.
- US residents: consider a credit freeze with the three bureaus; a licence number plus your photo is enough for many account-opening scams.
- Treat unexpected calls or emails that quote your licence details as suspicious.
- Ask your state licensing office whether a replacement licence with a new number is possible if you see misuse.
- See our guide on what to do after a data breach notice.
Sources
More breaches in United States
- Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) — 27 Aug 2026
- Boston Scientific — 26 Aug 2026
- Aesto Health — 14 Aug 2026
- DentaQuest — 17 Jul 2026
- Abbott (Exact Sciences) — 16 Jul 2026