What Happened to IDScan.net?

IDScan.net has established itself as a key player in the identity verification and fraud prevention industry, offering a suite of solutions including ID scanning, age verification, access management, and remote identity verification. The company's technology is utilized across various sectors such as retail, hospitality, cannabis dispensaries, and financial services, processing over 21 million verifications monthly at more than 20,000 locations worldwide.

However, the company's reputation and the security of its operations came under severe threat in early September 2026. Cybersecurity journalist Brian Krebs reported on a dark web service named Nexus that claimed to be selling a massive trove of identity documents, including over 153 million U.S. and Canadian driver's licenses. Investigations by Krebs and other researchers linked the timestamps on these stolen licenses to instances where individuals had their IDs scanned by businesses using IDScan.net's technology, such as Hertz car rentals and Planet 13 cannabis dispensaries, both listed as IDScan.net clients.

The alleged breach is significant not only due to the sheer volume of data exposed but also the nature of the information, which includes front-and-back scans, infrared, and ultraviolet images of government-issued IDs. This level of detail makes the exposed data highly valuable for identity theft and synthetic identity fraud, as the information is difficult, if not impossible, for individuals to change. The dark web service, Nexus, claimed to have been continuously exfiltrating new data for over a year, indicating a prolonged compromise.

In response to the reports, the FBI's New Orleans field office launched an official investigation into the apparent breach involving IDScan.net on September 1, 2026. IDScan.net issued a customer notice acknowledging the information and stating they were "working urgently" to confirm the scope of any unauthorized access. Shortly after the reports gained traction, the Nexus dark web service was shut down, though the data is presumed to be still circulating among cybercriminals.

As of September 4, 2026, the FBI investigation is ongoing, and several class-action lawsuits are being investigated against IDScan.net on behalf of individuals whose data may have been compromised. This incident has cast a spotlight on the broader identity verification industry, raising critical questions about data retention policies and the security measures employed by third-party verification providers. The long-term consequences for IDScan.net, its customers, and the millions of affected individuals remain to be fully seen. It's important to note that a separate company, IDscan Biometrics, was acquired by GBG in 2016 and operates as GBG IDscan, focusing on similar identity intelligence solutions.