Loading story…
Identity-verification provider IDScan confirmed that attackers stole data from its cloud systems during a reportedly year-long intrusion. The compromised dataset includes full names, driver’s-license numbers, and identification numbers from other government documents, including passports; IDScan holds more than 150 million driver’s-license records.
The records were advertised on a dark-web marketplace and reportedly searchable for more than 150 million people in the United States and Canada, potentially including photographs. The seller and breach method have not been publicly identified, while IDScan continues its investigation and the FBI is investigating; the Pentagon said it was aware of reports that Defense Secretary Pete Hegseth’s information appeared in the database.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
A database purportedly containing records from 153 million driver's licenses was advertised for sale on a dark-web marketplace. The listing did not identify the seller, the source organization, or independently verify the claimed record count.
In its September 4 breach notice, IDScan said it would notify potentially impacted individuals and provide free credit-monitoring and identity-protection services following the possible copying of customer information from IDScan.net cloud accounts.
IDScan said it received information about a claim that it had been hacked on or around September 1. The company later began investigating the alleged compromise.
The Nexus marketplace, which reportedly offered access to the exposed driver's-license database, disappeared from the dark web shortly after reporting on the breach was published.
The FBI said it was investigating the suspected IDScan breach, while the Pentagon said it was aware of the incident because information associated with U.S. Secretary of Defense Pete Hegseth was reportedly present in the exposed database.
Independent reporting found that a dark-web site allowed searches of driver's-license data for more than 150 million people in the United States and Canada, including photographs. Brian Krebs verified apparent authenticity using his own record; the reported data also included records associated with Defense Secretary Pete Hegseth and a security researcher.
IDScan acknowledged that hackers stole driver's-license data from its cloud environment, in what its website notice described as the company's first acknowledgement of a hack. The company said the stolen information included full names, driver's-license numbers, and identification numbers from other government documents, including passports.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcetherecord.media
Open sourcetechcrunch.com
Open sourceschneier.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly launched dark-web identity-theft service, **Nexus**, is offering scans of more than 153 million U.S. and Canadian driver’s licenses alongside millions of other identity documents. The operators claim to have continuously exfiltrated records from a major identity-verification provider for more than a year, and its inventory reportedly increased by nearly 400,000 license records within 24 hours. The listings include front-and-back document scans, including infrared and ultraviolet image formats. Victim accounts and image timestamp correlations tied records to identity checks at travel locations, car-rental agencies, and marijuana dispensaries, pointing to Louisiana-based identity-verification provider **idscan.net** as a possible source; the attribution has not been conclusively confirmed. The FBI’s New Orleans field office opened an investigation into the apparent compromise, while idscan.net said it was investigating without providing substantive public details. The exposure creates risks of identity and new-account fraud, biometric misuse, stalking, and physical harm, particularly for government personnel and people seeking to protect their identity or location.
Sep 7, 2026
Texas Parks & Wildlife disclosed a data breach affecting more than **3 million people** after the state’s cybersecurity unit detected unauthorized access involving the department’s license system vendor. The exposed data was tied to hunting and fishing license transactions and included **driver’s license numbers, passport numbers, email addresses, phone numbers, and residential addresses**, according to reporting and statements attributed to the Texas attorney general. The agency said the intrusion involved a vendor system used to process license information, but it did not identify the vendor or disclose the exact timing or method of the compromise. Officials also did not say whether the attackers had contacted the department, leaving key questions unanswered as the incident stands as one of the largest reported data breaches affecting Texas this year.
Jun 29, 2026
AssuranceAmerica disclosed a data breach affecting **6.99 million people**, exposing names, contact details, **driver’s license numbers**, and other insurance-related information tied to auto insurance policies, accounts, drivers, vehicles, and customer claims. The company said it discovered attackers in its systems on March 17 and completed its investigation on June 15, concluding that customer data had been stolen in what appears to be the largest known reported exposure of Americans’ driver’s license information this year. The insurer said the intrusion involved a targeted employee account and that the compromised credentials were later disabled, but it did not disclose the exact intrusion method or whether extortion or ransom demands were involved. Filings with the Indiana and Maine attorney general offices corroborated the scale of the breach, and customer notification letters are expected to begin on July 10.
Jul 10, 2026