153 million driver’s licences, and no letter coming

On 1 September 2026 Brian Krebs published an account of a dark-web service called Nexus, promoted on a Russian-language cybercrime forum, that sold lookups into a collection of identity documents it said covered more than 170 million people in North America. He found his own licence in it, and his mother’s, captured seconds apart on a day the two of them handed their IDs to the same rental counter. Reuters reported the following day that the FBI was investigating; the New Orleans field office took it, and coverage attributes some of that speed to agents finding their own documents in the same service. By 3 September the reporting was naming IDScan.net, a New Orleans identity-verification company, as the likely source. Nexus went offline shortly after the first story. IDScan has published no statement, and told Krebs only that it was investigating.

Age and identity checks are outsourced almost everywhere they happen. When a dispensary scans your licence at the door, when a rental desk photographs it before handing over keys, when a casino verifies you at the cage or a bank opens an account, the scanner and the software behind it usually belong to a vendor, not to the business in front of you. IDScan.net is one of those vendors, and reporting has named Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment among its customers. That structure is the whole shape of this story: one company holds documents belonging to people who have never heard of it, none of those people has an account to check, and the letter that would normally tell you cannot be written until each client business works out whose scans were involved.

Not a row of text. From the records reporters retrieved, an entry holds the front and the back of the document as images, along with infrared and ultraviolet captures of the same card and a timestamp of when it was scanned. Everything printed on a licence is therefore in it: full legal name, date of birth, home address at the time, licence number, expiry date, the photograph and the signature. The infrared and ultraviolet layers are the part that separates this from the usual leaked spreadsheet, because those are the hidden security features a verification scanner checks, and they were captured precisely so that a machine could confirm the document was genuine. A file built to prove that a licence is real is a good starting point for making one that looks it.

Nobody can tell you, including us. There is no lookup, no published copy of the data for researchers to index, and no public breach database that covers document scans, because those are built around email addresses. The only honest test is a question about your own habits: in the past few years, has a bar, dispensary, rental counter, casino, bank or delivery depot scanned your licence rather than glanced at it? If the answer is yes, you are inside the group this could reach, and there is no way to narrow it further until IDScan or its clients say which businesses and which periods were involved. That is uncomfortable, and it is better than the alternative, which is a site that offers certainty in exchange for a photograph of your ID.

Four things, in this order. Freeze your credit file at Equifax, Experian and TransUnion, which is free and is the only step that stops an account being opened rather than reporting it afterwards. Call your state motor vehicle agency, ask whether a duplicate licence has been issued in your name, and ask what flags they can put on a record that may be compromised. Request an Identity Protection PIN from the IRS, because a name, a date of birth and an address are the working set for a fraudulent return. And read your credit reports at annualcreditreport.com rather than waiting for an alert, since the data has been circulating for longer than the news has. If something has already been opened in your name, start at identitytheft.gov: the report it produces is what banks and agencies ask for, and having it saves telling the story from scratch to each of them.

Two kinds, and both work because the news is real. The first offers to check whether your licence is in the leak, and asks you to upload it. Read that sentence twice: the pitch is to hand over the document that is supposed to have leaked, to someone who found you through a headline. The second arrives later and talks about a settlement, a claim number or compensation, and asks for a bank account or a licence number to release the money. Cases were indeed filed in Louisiana from 2 September, which is exactly what makes the letter plausible; what does not follow is anyone emailing you for details before a class exists. Neither of these needs a password, which is why nothing you can reset defends against them.

A licence expires and gets reissued. The name, date of birth and home address printed on it do not, and they are already published by people-search and data-broker sites that assembled them from public records long before any of this. That matters here in a specific way: a stolen document photo is far more useful to someone who can also confirm where you live now and which relatives share your surname, because that is what turns a picture into a passable application. Getting those listings taken down is the one step on this page with an effect that outlasts the news cycle, and it needs re-checking rather than doing once. The shorter version of the response to any breach is in our post-breach guide, and the notification-letter guide covers how to read what a company eventually sends you.