IDScan Data Breach: What to Do If Your Driver's License Was Exposed

A data breach at IDScan, an identity-verification company used by bars, entertainment venues and other businesses to check government-issued ID, has exposed driver's-license and other government ID data belonging to people across the United States and Canada. IDScan disclosed the incident in a notice dated September 4, 2026, after security journalist Brian Krebs reported that a dark-web service was offering searchable access to the stolen records. Reported estimates of the total scale run into the hundreds of millions of records; see "What happened, as reported" below for exactly what is and is not confirmed. This guide sets the headline number aside and focuses on what to actually do if your driver's license or ID may have been exposed.

Primary sources: Krebs on Security, original report · TechCrunch, IDScan confirmation · GovInfoSecurity, IDScan breach notice · TechCrunch, worst breaches of 2026 roundup

What happened, as reported

On August 31, 2026, a source alerted security journalist Brian Krebs to a dark-web service called Nexus, advertised on the Russian-language cybercrime forum Exploit; Krebs published his report on September 1. IDScan's own notice says that "on or around September 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization," involving customer information stored in accounts on its cloud. The company's notice is dated September 4, 2026; TechCrunch's article confirming the breach ran on September 10. IDScan has acknowledged that an unauthorized party may have accessed customer data, and says it is offering free credit monitoring to affected individuals, has set up a hotline at 1-833-516-2980, and is cooperating with federal law enforcement. According to Krebs's reporting, the exposed fields include full names, driver's-license numbers, license photos, and identity numbers from other government-issued documents such as travel or international IDs; Krebs found no passports in the data set. The sellers behind the Nexus listing claimed to have been collecting this data for over a year, a claim that has not been independently verified.

Two different numbers have circulated, and they mean different things. Krebs reported that the Nexus service claimed to hold "more than 153 million" U.S. and Canadian driver's licenses, which is the seller's own claim about the stolen data set. Separately, TechCrunch reported that IDScan's website states the company holds "over 150 million" records, which is IDScan's own description of its total holdings, not a count of how many people were affected by this incident. IDScan has not published a count of affected individuals, and nobody outside the company and the seller has audited either figure. Treat both numbers as reported estimates of scale, not confirmed totals. What matters for you is simpler: if you have ever had your driver's license or ID scanned by a business that uses ID-verification technology, such as a bar, concert venue, dispensary, or similar checkpoint, in the United States or Canada, you should assume you could be among those affected and take the steps below.

Why a leaked driver's license matters

A driver's license is not just a photo ID. It carries a unique license number, your full legal name, date of birth, and address, all of which double as identity-verification data at banks, lenders, and government offices. When that combination leaks, it can be used for:

• Synthetic identity fraud. Criminals combine a real license number with a different name or Social Security number to build a new, hard-to-trace identity for opening accounts.
• Account-opening fraud. A license photo and number are often enough to pass "identity verification" checks at banks, buy-now-pay-later services, or cell-phone carriers, letting someone open credit in your name.
• Counterfeit IDs and citation fraud. Images of the front and back of a license can be used to make counterfeit IDs or to pass remote identity checks that only look at a photo of your ID. There is also a risk that tickets or citations could be issued in your name if someone presents a copy of your license during a stop.

Unlike a credit card, you cannot simply cancel a driver's license number and get a new one instantly, which is exactly why the steps below matter.

What to do right now

1. Freeze your credit at all three bureaus. Credit freezes are free by law and stop most new accounts from being opened in your name. Freeze with Equifax, Experian, and TransUnion separately, since a freeze at one bureau does not cover the others. You can lift a freeze temporarily whenever you need to apply for real credit.
2. Place a fraud alert. A one-year fraud alert requires lenders to verify your identity more carefully before issuing credit. If you file an FTC Identity Theft Report (see below), you can instead place an extended fraud alert, which lasts seven years. You only need to request an alert from one bureau; it notifies the other two automatically.
3. Contact your state DMV about your license number. A leaked license number is not automatically replaced. If you see signs of misuse, such as unfamiliar citations, a duplicate-license request you did not make, or notices about a vehicle you do not own, contact your state's Department of Motor Vehicles (or equivalent) to ask about reissuing your license with a new number. Replacing a license is usually warranted once there is any sign of actual misuse, not simply because a data set may have included your record.
4. Consider an IRS Identity Protection PIN. An IP PIN blocks anyone else from filing a tax return using your Social Security number. It is free through the IRS and worth adding if your identity documents may be circulating.
5. Monitor your accounts and credit reports. Check bank and card statements regularly. All three bureaus offer free credit reports weekly at AnnualCreditReport.com, the only site authorized under federal law for free reports from all three bureaus.
6. File a report. Report identity theft at identitytheft.gov (FTC), which generates a personal recovery plan and an FTC Identity Theft Report. Contact your state DMV if you see signs of misuse, such as unfamiliar citations or an unauthorized duplicate-license request. Rules vary by state, and many require a police report or proof of fraud before issuing a new license number. If you lose money to a scam connected to this breach, file a report with the FBI's Internet Crime Complaint Center at ic3.gov.

Canadian readers: Krebs reported that about 1.1 million of the exposed records are Canadian. If that applies to you, report the incident to the Canadian Anti-Fraud Centre and contact Equifax Canada and TransUnion Canada about a fraud alert or credit freeze.

Watch for follow-on scams

Large breaches like this one are quickly followed by opportunistic phishing and vishing campaigns that use the news itself as bait. Be skeptical of any message, call, or text claiming "your driver's license was leaked, click here to check" or "verify your identity to prevent fraud." These are rarely from a real DMV, bank, or credit bureau. Real notifications about this breach will not ask you to enter your Social Security number, license number, or bank login through a link in a text or email.

If you have already clicked a suspicious link related to this breach or anything similar, our guide on what to do after clicking a phishing link walks through containing the damage. For a broader look at how these scams are built and why they work, see how phishing works and how to stop it.

FAQ

Are the "150 million" and "153 million" figures confirmed?

No. The 153 million figure is Krebs on Security's report of what the Nexus dark-web service claimed to hold; the "over 150 million" figure is TechCrunch's report of what IDScan's own website says about its total record holdings. Neither is a confirmed, audited count of people affected by this specific incident, and IDScan has acknowledged that an unauthorized party may have accessed customer data without giving its own number. Act on the assumption that your data could be included if you have had ID scanned by a business using this kind of verification technology.

Do I need to replace my driver's license?

Not automatically. A license number leak is serious, but a full reissue is generally warranted once you see actual signs of misuse, such as unauthorized citations, vehicle registrations, or duplicate-license requests. Contact your state DMV to discuss your options; rules vary by state, and many require a police report or proof of fraud before issuing a new license number.

Will a credit freeze stop someone from using my license number to open an account?

A freeze makes it much harder for a fraudster to open new credit accounts in your name, since lenders cannot pull your credit report without lifting it first. It does not by itself protect against every use of a license image, such as a counterfeit ID or impersonation during a traffic stop, which is why combining a freeze with DMV monitoring and a fraud alert gives you broader coverage.

Sources: Krebs on Security · TechCrunch (IDScan confirms breach) · GovInfoSecurity (IDScan breach notice) · TechCrunch (worst breaches of 2026) · identitytheft.gov (FTC) · IC3 (FBI)

If you have been targeted, you are not alone. See our country-by-country cybercrime help hub for step-by-step reporting and recovery guides.