Science & Technology
You probably do not remember the moment it happened. You were at a rental car counter in a strange airport at the end of a long flight. Or standing in the doorway of a cannabis dispensary in Las Vegas. Or checking into a hotel at midnight with a bag sliding off your shoulder. Someone in a polo shirt took your driver licence, turned away for a second, and slid it into a small grey box. Then they handed it back and smiled. That was it. That was the moment.
That small grey box did not just read your date of birth. According to the documentation of the company that makes it, it took as many as six images: the front of your licence, the back of it, a plain optical scan, an infrared version and an ultraviolet version - the security layers that prove a licence is genuine. It stamped each file with the date and the time, down to the second. Then it sent them into the cloud.
On Thursday, the company behind a great many of those grey boxes finally admitted what independent researchers had been shouting for ten days. IDScan.net, a Louisiana firm that most Americans have never heard of but which by its own published figures holds more than 150 million driver licence records, confirmed that an unauthorised third party accessed and copied customer information from its systems.
The stolen data, the company said in a notice posted on its own website, may include full names and driver licence numbers, along with identification numbers from other government-issued documents such as passports. It is the first time the firm has acknowledged an intrusion at all. It has not said how many people are affected. It did not respond to questions from reporters about whether the hackers demanded a ransom.
The entire business of proving you are you had, quietly, become the largest single supply of material for pretending to be you.
It started with a free sample
The story did not break through a regulator, an auditor or a corporate disclosure. It broke because a criminal advertised on a Russian cybercrime forum called Exploit - and picked the wrong free sample.
On Monday, August 31, a source alerted the independent cybersecurity journalist Brian Krebs to a new listing offering access to digital scans of identity documents belonging to more than 170 million people across North America. The proprietor of the service, which called itself Nexus, had thoughtfully attached a freebie to the sales thread to prove the goods were real. It was Krebs own Virginia driver licence.
The numbers Nexus claimed were staggering, and a look inside suggested they were not exaggerating. More than 153 million driver licences from the United States and Canada. More than 10 million identification cards. More than three million travel documents and international IDs. At least 579,000 medical cards. A blank search - no name, no state, no filters - returned roughly 11.5 million pages of results at about 15 results per page.
Canadian records alone ran to around 1.1 million, with the heaviest concentration in Ontario at 473,673. Oddly, the trove included marijuana dispensary cards. Some records were tagged with a source of CDL, presumably commercial driver licence. Others carried the notation CAC, which may refer to Common Access Cards - the credentials that let people through the doors of United States government buildings and into secure rooms.
And the pile was growing in real time. Over a single 24-hour stretch, the number of licences listed in the service rose by nearly 400,000. In its own introductory post, the seller boasted of continuously exfiltrating new data for over a year into a private database. This was not a smash-and-grab. This was a tap that had been left running.
The timestamps that cracked it open
What turned a dark web listing into a named company was a piece of detective work so ordinary it is almost funny: a man checked his calendar.
Each image file in the Nexus records carried a date and time in its filename. The timestamp on Krebs own licence matched a June 2025 flight he took to the American midwest for a family funeral. His first theory was airports. That theory died quickly - there were no passports in the data set, and not everyone whose licence turned up had shown ID at a security checkpoint.
So he asked more than a dozen friends and relatives for permission to search for their licences. Nine were in there. Every single one confirmed travelling on or very near the date stamped on their images. Car rental paperwork shared by several of them suggested the timestamps were set to Greenwich Mean Time.
Then came the detail that sealed it. Krebs found his own mother in the database, and the timestamps on her images were just a few seconds apart from his. The two of them had handed their licences to the same Hertz rental car representative at the same moment. By his mother account, the rental counter was the only place she surrendered her licence that day. The clerk had held both cards behind the counter for several minutes while the paperwork was signed.
Two federal employees who helped with the research said they had used other government identification at airport security - but had shown their state driver licences later the same day while renting cars. Both had rented from Hertz.
The privacy researcher Zach Edwards, who recently launched a tracking-transparency service called DecryptAds, found his own licence on offer. His timestamp pointed to a trip to Las Vegas for the DEFCON security conference. He had not rented a car. He had handed his licence to a TSA officer, to his hotel, and to a dispensary - and the only one of the three that he was certain had physically scanned it in a device was the dispensary, a branch of the multi-state chain Planet13.
In 2022, IDScan.net published a press release announcing an exclusive identity verification agreement with Planet13 nationally. The firm says it handles ID verification for more than 1,000 marijuana dispensaries across 19 American states.
The company you never chose
Here is the uncomfortable part. You never signed up with IDScan.net. You never agreed to its terms. You may never have seen its name until this week. And yet, if the researchers are right, it has photographed your face under ultraviolet light and filed the result.
By its own account, the company processes more than 21 million verifications every month at more than 20,000 locations worldwide. Its trust page has listed an eye-watering roster of corporate customers: the rental giant Hertz, the retailer Target, the shipping company FedEx, Motorola Solutions, the financial services firm Jack Henry and the casino group Caesars Entertainment, alongside the dispensary network.
Caesars pushed back hard. A spokesperson said the company has not been an IDScan.net client, has not used the VeriScan product since February 2025, had no active accounts at the time of the incident, and did not authorise the retention of any data from its accounts - adding that IDScan.net had told them the incident should have no impact on Caesars. In other words, one of the marquee names on the client list says it should not have been on the client list at all. Which raises the question of how long data lingers in these systems after a customer walks away.
You cannot reissue your face. You cannot rotate your jawline the way you rotate a password.
A conference call with six FBI agents
Word travels fast when a reporter starts poking at a database containing the identity documents of senior officials. Nexus was offering, among 153 million others, the driver licence of the United States Secretary of Defense, Pete Hegseth. It also carried the licence of an assistant director of the FBI.
On September 1, Krebs was added to a conference call with around half a dozen FBI agents, including senior leaders from the bureau cyber division. On that call, the FBI disclosed that its New Orleans field office - the field office covering IDScan.net home state - had that day opened an official investigation into an apparent breach at the company. The Pentagon separately confirmed it was aware of the suspected breach.
Hours after the story published, the Nexus site vanished from the dark web. Its login page was replaced with a flat line of text: this service is no longer available. Nobody believes that means the images are gone. Data does not evaporate because a shopfront closes; it moves.
IDScan.net first said it was investigating. On September 8 it posted a brief notice saying an unauthorised third party may have accessed or copied certain customer information, and that it was notifying affected individuals and offering credit protection services. On September 10 the confirmation firmed up further - and included a curious phrase noting that full access to the information required payment, which reads very much like a reference to the criminals paywall, or to a demand made of the company itself.
What the experts are actually worried about
Larry Baldwin, principal intelligence researcher at the cybersecurity firm Cybera, found a front-and-back scan of his own licence in the service, timestamped to a Hertz rental on a recent holiday. His concern is not embarrassment. It is credit.
State-issued driver licences are the workhorse proof of identity when someone opens a new line of credit. A high-resolution front and back scan, complete with the infrared and ultraviolet layers that verification systems use to detect forgeries, is not merely a photograph. It is a template.
Baldwin also raised a category of victim that rarely makes headlines: people who do not wish to be found and cannot meaningfully change how they look. Survivors fleeing domestic violence. People given entirely new identities under the federal witness protection programme. Today image-matching tools driven by artificial intelligence can connect a face across databases in seconds. A new name offers thin cover when the old photograph is searchable.
As Baldwin put it, just when it seems like progress is being made in improving authentication controls through driver licence verification systems, this happens - and the very thing those improvements depend on is compromised.
Edwards drew the broader political lesson. As more and more online and in-person experiences demand a licence scan, often justified in the name of protecting children, the sensitive data lands in more and more third-party vendors. His argument is blunt: these systems are putting sensitive data into ever more hands, and there is nowhere near enough oversight to ensure it is safe.
The lawyers arrived in 72 hours
If the regulatory response has been slow, the litigation has not. Between September 2 and September 4 - before IDScan.net had confirmed anything publicly - nine putative class actions were docketed against the company in the United States District Court for the Eastern District of Louisiana. Multiple law firms have since opened public investigations soliciting affected consumers.
The complaints lean on familiar theories: negligence, breach of implied contract, breach of fiduciary duty, and in some filings fraud or unjust enrichment. The core allegation is straightforward. A company accumulated one of the largest concentrations of government identity documents in North America, held it in the cloud, and - on the criminals own telling - failed to notice a year of exfiltration.
Whether any of that survives a motion to dismiss is a question for the courts, not a tabloid. But the litigation does one useful thing immediately: discovery is the only mechanism likely to force out the number IDScan.net has so far declined to give, which is how many individuals were actually affected.
What this means for you
Start from the honest premise. If you have rented a car, entered a dispensary, checked into certain hotels, or passed through a venue that scans identification, there is a real chance your licence images are in this data. There is no public lookup tool; the one place people could check has been taken offline.
The single most effective step is a credit freeze, and it must be done at all three major bureaus separately - Equifax, Experian and TransUnion. A freeze is free, it can be lifted temporarily when you genuinely need credit, and it is far stronger than monitoring, which only tells you after the damage is done. Credit monitoring offered by a breached company is a consolation prize, not a shield.
Consider whether your state will reissue your licence with a new number. Policies vary widely and many states will not do it simply because of a breach, but it is worth the phone call, because the licence number is the piece of the record that can actually be changed.
Expect a wave of scams riding on this story. Breach notifications are catnip for phishing. Nobody legitimate will call you demanding your Social Security number to protect you from this incident. Treat any unsolicited message referencing the breach as hostile until proven otherwise, and go to the company website yourself rather than following a link.
And from now on, ask. When a clerk reaches for a scanner, it is entirely reasonable to ask whether the image is stored, for how long, and by whom. Most staff will not know. That, in itself, is the finding.
The irony at the heart of it
There is something almost perfectly circular about this breach. The infrared and ultraviolet scans exist precisely because a plain photocopy is too easy to fake. They are the proof of authenticity. Which means the exact technical artefacts built to stop impersonation are now the most valuable possible raw material for impersonation - collected, standardised, indexed and, allegedly, siphoned off for a year.
Every verification system that stores identity as an image carries the same latent flaw. Verification is a moment. An image is forever. A person standing at a counter cannot be copied and reused; a file of that person can be, endlessly, by anyone who buys it.
The FBI investigation continues. The lawsuits are stacking up in New Orleans. The dark web storefront is gone, and the data is not. Somewhere in a data centre, there is still a folder with your name on it, six images inside, timestamped to the afternoon you rented a car and thought nothing of it at all.
