On September 1, 2026, a dark web marketplace called “Nexus” began advertising over 153 million high-resolution scans of U.S. and Canadian driver’s licenses. The data traces back to IDScan.net, a Louisiana-based identity verification and KYC (Know Your Customer) vendor, and it’s one of the largest compromises of physical identity documents on record. Nearly half the North American population has data in this breach, and the incident has reopened a hard question about third-party identity verification supply chains: who’s actually responsible for securing this data once it leaves your hands?

This piece walks through how the breach happened, how the Nexus marketplace operated, the legal fallout so far, and what enterprises and consumers should do now.

How 153 Million IDs Got Out

IDScan.net processes more than 21 million ID checks a month for clients that include cannabis dispensaries, firearms dealers, and larger companies like Hertz and Target. Its core service scans physical government-issued IDs, runs Optical Character Recognition (OCR) to pull the data out, and checks the document against various databases for authenticity.

The breach happened when an unauthorized party got into IDScan’s cloud infrastructure and pulled data from the repositories storing scanned images and parsed metadata. IDScan hasn’t published a CVE or detailed the exact attack vector, but the scale of what was taken, over 153 million high-fidelity image files plus structured database records, points to something more than a basic application flaw.

In cloud-native KYC platforms, image handling is usually offloaded to object storage like AWS S3, Google Cloud Storage, or Azure Blob Storage to handle the volume. A breach this size rarely comes from a simple SQL injection; it usually points to a compromise at the cloud infrastructure layer. A few vectors fit the pattern:

• Compromised IAM credentials: leaked keys with overly permissive s3:GetObject policies, letting attackers bulk-download entire storage buckets.
• Server-side request forgery (SSRF): a flaw in the ID parsing API that let attackers pivot to the internal cloud metadata service (AWS IMDSv1, for example) and harvest temporary credentials.
• Misconfigured object storage: bucket policies that accidentally granted public read access to file directories, skipping application-layer authentication entirely.

Pulling that many heavy image files without tripping standard application-layer rate limits suggests the attackers used direct-to-storage transfer rather than the front-end API, which would let them move terabytes without triggering the alarms built around normal traffic.

It’s Not Just Driver’s Licenses

The driver’s license numbers alone are bad enough, but the rest of what’s in the Nexus database makes this worse. Cybersecurity journalist Brian Krebs reported that the compromised database also contains scans of 10 million state ID cards, 3 million travel documents including passports, and nearly 579,000 medical cards.

Pair high-fidelity facial photos with full names, addresses, dates of birth, and government ID numbers, and you get a complete identity kit. Krebs checked the database’s validity by searching his own records, along with those of U.S. Secretary of Defense Pete Hegseth and a security researcher who agreed to have their data checked. That’s a strong signal this isn’t a recycled dump from an old breach but a fresh, accurate extraction of current data on North American residents.

Nexus and the Subscription Model for Identity Theft

Nexus, allegedly tied to Russian cybercriminal groups, didn’t work like a typical dark web forum where data gets dumped in unstructured archives. It ran on a tiered subscription model: pay in crypto, get searchable access to the database. Users could look people up by name, license number, or region.

That structure lowers the bar for low-level scammers who want to run targeted phishing, synthetic identity fraud, or account takeovers against specific people. The Nexus front end went offline shortly after Krebs’ report, but the data itself is almost certainly already mirrored across other dark web forums, Telegram channels, and private markets. Taking down the storefront doesn’t undo the leak.

The KYC Supply Chain Problem

This breach points at a real gap in how companies think about security. Plenty of organizations run strict Zero Trust internally while extending broad trust to third-party identity verification APIs. When a retailer or bank plugs IDScan’s SDK or REST API into onboarding, they’re inheriting whatever security posture IDScan actually has, not the one on paper. If the vendor’s backend doesn’t segment its network properly, a compromise in a low-stakes staging environment can become a path into production.

There’s also a data retention problem. Many KYC vendors hold onto parsed data and raw images for “model training” or audit purposes, which cuts against basic data minimization and turns a verification tool into a long-term target. One industry estimate puts the share of malicious activity blocked by valid-credential checks at 37 percent, which sounds useful until the vendor’s own backend is the thing that’s compromised, at which point that perimeter defense does nothing.

Lawsuits and an FBI Investigation

The legal response has moved fast. As of September 8, 2026, at least nine class-action suits have been filed in the Eastern District of Louisiana, alleging negligence, breach of implied contract, and failure to protect consumer data. The FBI’s New Orleans field office has opened an investigation and is working with IDScan’s internal forensics team.

IDScan’s handling of the disclosure hasn’t helped its case. The company posted a breach notification on September 4 but tagged the page noindex, which keeps it out of search results and makes it harder for affected people to find. IDScan has also pointed out that “full access required payment,” as if that limits the damage. It doesn’t: once one buyer has the data, it gets copied, resold, and reused across the ecosystem regardless of the original paywall.

What Consumers Should Do Now

If you’ve had your ID scanned at a dispensary, a car rental counter, a gun store, or a venue at any point in the last few years, assume your data is in this breach. A few defensive steps are worth taking immediately:

• Freeze your credit. This is the most effective single step. Contact Equifax, Experian, TransUnion, and Innovis and place a hard freeze on your credit files. It stops new credit lines from being opened even if someone has your license number and SSN.
• Watch for synthetic identity fraud. Criminals sometimes pair your real ID number with a fake name or address to build a new credit profile. Check your credit reports for inquiries or authorized-user additions you don’t recognize.
• Be skeptical of anything asking you to “verify.” With your full name, address, and ID number, scammers can write convincing phishing emails or texts posing as your bank, the DMV, or the IRS. Treat unsolicited verification requests as suspicious by default.
• Sign up for the monitoring IDScan is offering. It won’t catch everything, but free credit monitoring and identity protection give you an added layer of alerts if your data shows up elsewhere.

What Enterprises Should Do About Their Own Pipeline

For CISOs and security architects, this breach is a reason to audit third-party API risk now rather than after the next one.

1. Cut retention. Configure identity verification workflows to discard high-resolution ID images as soon as parsing finishes. Don’t let vendors keep raw images for “future model training” without explicit consent and a real security audit behind it.
2. Lock down API access. Use short-lived OAuth tokens, mutual TLS, and IP allow-listing on every vendor integration. Rotate API keys regularly and scope them to the minimum permissions the integration actually needs.
3. Monitor vendors continuously. An annual SOC 2 Type II review isn’t enough. Use automated security rating tools to watch KYC vendors for exposed credentials, misconfigured cloud storage, and dark web mentions as they happen.

Where This Leaves Us

The IDScan breach shows what happens when identity verification becomes centralized: 153 million records are now circulating in the criminal underground, and the company that scanned them bears just as much responsibility for protecting them as the governments that issued the original documents. As age and identity verification requirements expand across platforms and jurisdictions, these honeypots of physical ID data are only going to grow. Until the industry moves to a verify-and-discard model for biometric and physical ID data, breaches like this one will keep happening.