You hand your driver's license to the bartender to check your age. Or to the rental car counter. Or to a dispensary. They scan it, front and back, and hand it right back. That scan goes to an identity verification company so that it can verify and cross reference you.
In September 2026, one of those companies became a case study in why that should worry you. Security researchers found more than 153 million driver's license scans for sale on a dark web marketplace called Nexus. Also in the haul: 10 million ID cards, 3 million passports, and 579,000 medical cards. All of it traced back to a Louisiana identity verification company called IDScan.net.
Why this breach is different
Most breaches leak a name, an email, maybe a Social Security number. This one leaked the documents themselves. Full front and back scans. Some in infrared and ultraviolet, the versions used to check if an ID is real. That's a higher grade of theft. A stolen SSN lets someone apply for credit in your name. A stolen license scan lets someone build a far more convincing fake ID or account, using your actual photo.
The scale of who uses services like this is the uncomfortable part. IDScan.net's technology checks ages and identities at bars, cannabis dispensaries, and car rental counters. Reporting connected it to Hertz and the cannabis retailer Planet13. Caesars Entertainment said it had used IDScan in the past, but stopped in February 2025, before this exposure. The stolen data had reportedly been collected for over a year. New scans were being added at a rate of around 400,000 a day, right up until the marketplace shut down.
Big enough that the FBI's New Orleans field office opened a formal investigation on September 1, 2026. The story broke wide after researchers found something specific for sale: the driver's license of a sitting U.S. Defense Secretary. If someone in that position isn't exempt, a routine ID check at a rental counter isn't either.
What to do if you've had your ID scanned recently
There's no single official lock for a stolen document image, not the way there is for an SSN. But the same defenses that work against any large identity breach still apply. They matter even more here, since the leaked data includes your actual photo.
- Freeze your credit. Free at Equifax, Experian, and TransUnion. It's still the single best block against someone opening new accounts with a convincing fake ID built from your real documents.
- Watch for account activity you didn't start. A stolen license scan often gets used to pass identity checks at banks or crypto exchanges, not just to make a fake physical ID. Set up transaction alerts wherever you can.
- Be suspicious of anyone who already has your details. Scammers with a stolen ID scan can sound very convincing on a call. They can describe your actual license back to you. Knowing your information is not proof of who someone is.
- Ask before you hand over your ID. You can ask a business what they do with a scanned ID and how long they keep it. You won't always get a good answer. It's still a fair question to ask.
None of this means stop renting cars or stop going to bars. It means treating a document scan the way you'd treat your SSN. Assume it can end up somewhere you didn't choose. Have your recovery steps ready before you need them.
Was your info in a breach tied to your email?
Our free scan shows which known breaches contain your email and whether identity data was exposed alongside it.
Run the Free Breach Scan →A document-scan breach like this one is hard to monitor yourself, since the exposure isn't just a password you can change. Aura watches for your information showing up in new breaches, dark web listings, and credit applications, and alerts you when it does.
Affiliate link. We may earn a commission if you sign up, at no extra cost to you.