Up to 153 Million Driver's Licenses Exposed — If a Bar or Store Has Ever Scanned Your ID, Read This
By Ricky Browning · Browning PC, Valdosta, GA
Short version: a company most of us have never heard of — but whose scanners have read a lot of our licenses — got breached, and a dark-web seller claimed to have a huge pile of driver's license scans from it. You can't un-leak a license number. What you can do is make that number useless to a thief, and it takes about half an hour tonight. I'll walk you through it, and then I want to talk to the business owners around here who run an ID scanner at the counter.
Key takeaways
- IDScan.net, an identity-verification vendor whose scanners check IDs at retailers, bars, rental counters, banks and dispensaries, confirmed a breach on September 4, 2026: an unauthorized party "may have accessed and/or copied" customer data in its cloud accounts.
- A dark-web service called Nexus put up for sale what it claimed were 153 million+ U.S. and Canadian driver's license scans, plus millions of ID cards and travel documents. It went dark hours after it was reported. The FBI is investigating.
- IDScan says the affected data "may include full names and driver's license or other government-issued identification numbers." Brian Krebs' reporting found actual license scan images in the seller's records.
- You likely can't find out whether you're in it. If your license has been scanned at a business in recent years, assume you could be.
- Do tonight: freeze your credit at all three bureaus (free), pull your reports, watch your mail. Georgia DDS can issue a new license number — worth it only if yours is actually misused.
- Business owners: ask your ID-scanner vendor what it keeps, for how long, and where. This breach is why.
What actually happened?
IDScan.net is a New Orleans-based identity-verification company. Its hardware and software sit at checkout counters and front desks and read the barcode on the back of a driver's license — to check age, to verify you are who your license says, to open an account. In a notice dated September 4, 2026, the company said it became aware on or around September 1 that "an unauthorized third party may have accessed and/or copied certain customer information" stored in customer accounts on its cloud platform, and that the affected data "may include full names and driver's license or other government-issued identification numbers." It says the investigation is ongoing and it's working with federal law enforcement; Krebs reported the FBI's New Orleans field office opened an inquiry.
The reason this went from "another breach" to a headline is the scale. Security reporter Brian Krebs reported on September 1 that a new dark-web service called Nexus was selling scans of government IDs and claimed to have been "continuously exfiltrating new data for over a year" from a major identity-verification company. The site went dark the same evening his story ran. The numbers it had advertised:
- 153 million+ U.S. and Canadian driver's licenses
- 10 million+ identification cards
- 3 million+ travel documents
- 579,000+ medical cards
Krebs' reporting says the scans included the infrared and ultraviolet images a scanner captures, with timestamps matching when the person handed over their license — and that roughly 400,000 new license records showed up in the service in a single 24-hour window. If the seller's claim is true, this wasn't one bad night — it was a leak running for a long time. IDScan hasn't said when the intrusion began.
I want to be careful with the numbers here, because I'd rather under-promise than scare you with something I can't back up. IDScan.net has not said how many people are affected. The 153 million figure comes from what the criminals were advertising, and criminals inflate. But the company has confirmed the intrusion, said what kind of data may be involved, and the FBI is involved. That's enough to act on.
Who uses IDScan — and was my license scanned by one?
Almost certainly you don't know, and that's the uncomfortable part. IDScan.net says it handles over 21 million verifications a month across more than 20,000 locations. IDScan's own customer page lists names like Hertz, Target and FedEx (none of which has said its customers were affected), and reporting describes industries including cannabis dispensaries, gun stores and banks. Any place that has ever swiped or scanned the back of your license — not just glanced at it — could be running their equipment, or a competitor's.
Think about where that happens around here:
| Where | Why they scan it | What usually gets kept |
|---|---|---|
| Package stores, bars, vape and tobacco shops | Age verification | Can be anything from a pass/fail to the full record — depends on the vendor and the settings |
| Car and truck rental counters | Identity + fraud check | Can be the full scan, tied to the rental |
| Banks and credit unions (new accounts) | Federal know-your-customer rules | ID type and number, kept for years by law |
| Pharmacies (certain prescriptions) | Pseudoephedrine and controlled-substance logs | License number, logged and kept |
| Hotels, some retailers (returns) | Fraud prevention | Varies widely |
| Car dealerships | Financing + test drives | Can be a full copy |
Let me be straight about the local part: I do not know which businesses in Valdosta or Lowndes County use IDScan.net specifically, and I'm not going to guess in print. What I can say is that the scanner at the counter is rarely something an owner picked for its security practices. It comes with the point-of-sale system, or the distributor recommends it, or it's the cheapest one that satisfies the compliance rule. Nobody asks what it keeps.
Why is a leaked driver's license number a big deal?
Because it's one of the handful of numbers that proves you're you. A license number plus your name and date of birth — which are printed right next to it — is enough to open some accounts, pass some identity checks, rent things in your name, or get a ticket in your name that you find out about when your insurance goes up. It's not as bad as a Social Security number, but it's one of the most useful things a thief can have, and unlike a credit card it isn't easy to replace.
The bigger risk is stacking. If the scan image is in there too, a criminal has a picture of your actual license — the layout, your photo, your signature. Combine that with the name, address and SSN from some other breach (and after the last few years, most of us are in several), and they have a complete kit. The FBI's Internet Crime Complaint Center logged over a million complaints in 2025, the first year it crossed that line, with losses above $20 billion. Identity theft is a volume business, and this just added a lot of inventory.
What should I do tonight?
Here's the order I'd work it. The first two are the ones that matter; the rest are cheap insurance.
Freeze your credit at all three bureaus
This is the single most effective thing you can do, and it's free — federal law has required free freezes since 2018. A freeze locks your credit report so lenders can't pull it, which makes it very hard for anyone to open new credit in your name until you lift it, and it does not affect your credit score. Do it at each bureau directly: Equifax, Experian, and TransUnion. About ten minutes each. Write down the PINs or logins somewhere safe. When you need credit — a car, a card — you lift it for a day online and put it back.
Pull your free credit reports and actually read them
AnnualCreditReport.com is the official free site — you can check all three bureaus weekly now, not just once a year. You're looking for accounts you didn't open, addresses you never lived at, and inquiries from lenders you never talked to. Do this once now, and again in a month or two, because stolen data gets used in waves.
Watch your mail and your insurance
A leaked license number tends to show up in physical ways: a bill for an account you don't have, a toll or ticket notice from somewhere you weren't, a welcome letter from a bank you've never used, or a surprise jump on your auto insurance renewal. Open the mail you'd normally toss. If something's wrong, that's your evidence for the next step.
If it's actually being misused: police report, then Georgia DDS
Don't run to the DDS office because of a headline — a new number is a hassle and you'd need to update your insurance, your bank and everywhere else that uses it. But if you see real misuse, file a report with local law enforcement, then contact the Georgia Department of Driver Services Investigative Services Section at (678) 413-8766. DDS says license-number changes must be requested in person at a DDS Customer Service Center with your current license or identity documents; standard fees apply. Also file at IdentityTheft.gov, which builds you a recovery plan and the letters you'll need.
Take the free monitoring if you're offered it — but don't wait on it
IDScan.net says it's notifying potentially affected people and offering free credit monitoring and identity protection; its line is 1-833-516-2980, Monday–Friday 8 a.m.–8 p.m. ET. If you get that letter, take the offer. But understand two things: the letter comes from IDScan or the business that scanned you, so it may never come, and monitoring only tells you after something happened. The freeze prevents it. Do the freeze first.
Expect scams that use this breach as the hook
Every big breach gets followed by texts and calls pretending to be "IDScan" or "your bank's fraud department" wanting to "verify your license number." That's the second scam riding on the first. A real breach notice never asks you to confirm the very data that was stolen. If you get one, hang up, and if you want the playbook for that whole family of calls, I wrote it up in how to not fall for fake text and phone call scams.
Business owners: your ID scanner is a liability you didn't price in
This is the part I actually want local owners to sit with. If you scan licenses — package store, bar, rental lot, dealership, clinic, anywhere — you are collecting some of the most sensitive data a customer has, and you probably don't know what your scanner does with it after the green light. Some systems keep nothing but pass/fail. Some keep the license number. Some keep the entire image, indefinitely, on somebody else's cloud. And if that cloud gets breached, your customers may never get a letter from the vendor — and as far as they're concerned, you leaked their license.
The ID scanner tends to be the piece of equipment that gets the least attention. It's just there, and the dashboard hasn't been opened since the day it was installed. Here's what I'd do this week, and it costs nothing but a phone call:
- Ask your vendor exactly what it keeps. A pass/fail result? The license number? The full image? Get it in writing — an email is fine.
- Ask how long it's kept, and shorten it. Age verification doesn't need to retain anything. If you're under a rule that requires retention (banks, pharmacies, some rentals), keep the minimum the rule requires and not a day more.
- Ask where it lives and who can reach it. If the answer is "our cloud" and nothing more specific, keep asking.
- Ask about breach notification. Will they tell you within a set number of days? Georgia's breach-notification law is narrower than most people assume, but your contracts, your card processor and the FTC can all put the obligation on you — so you need to hear about it fast.
- Turn off retention you don't need. Most scanners have a setting; some ship with storage on, some off. A verify-only mode reads the birthday, gives you a yes or no, and keeps nothing.
- Put it on the list with the rest of your systems. Your scanner is a networked device with customer data on it. It belongs in the same conversation as your Wi-Fi, your backups and your point-of-sale — more on that in cybersecurity for small businesses.
None of this is about ripping the scanner out. Age checks are the law and the scanner is faster and more accurate than eyeballing a birthdate. It's about knowing what you're holding, and holding as little of it as possible.
The bottom line
You didn't do anything wrong by handing your license to a cashier, and you can't take it back. But you can make the number worthless to a thief with a free credit freeze, and you can catch anything that slips through by reading the reports and the mail. That's thirty minutes tonight against what could be months of cleanup later. And if you own a business that scans IDs, this is the week to find out what your scanner is keeping — before a customer finds out for you.
🔒 Want help setting up the freeze, or checking what your scanner keeps?
I'll walk you through the three bureaus over the phone or sit down with you and do it together — and for business owners around Valdosta, Hahira and Lake Park, I'll look at your ID scanner, your point-of-sale and the rest of your setup and tell you plainly what's storing customer data and whether it needs to. No contracts, no pressure — just your local South Georgia tech guy.
📞 229-561-1674 ·
📅 Book an appointment
Common Questions
What is the IDScan.net data breach?
IDScan.net, a New Orleans-based identity-verification company whose scanners check IDs at retailers, bars, rental counters, banks and dispensaries, confirmed in a notice dated September 4, 2026 that an unauthorized third party may have accessed or copied customer information in its cloud accounts. A dark-web service called Nexus had put up for sale what it claimed were more than 153 million U.S. and Canadian driver's license scans taken from the company; the site went dark the evening it was reported, and IDScan has not said how many people are affected.
How do I know if my driver's license was in the IDScan breach?
You probably can't know for certain. IDScan.net says it is notifying potentially affected people and offering free credit monitoring, but it has not said how many people were involved, and it does not deal with you directly — the business that scanned your ID does. If your license has been scanned at a store, bar, rental counter or bank in the last few years, the safe assumption is that it could be in there.
What should I do if my driver's license number was stolen?
Freeze your credit at all three bureaus (Equifax, Experian and TransUnion) — it's free and takes about ten minutes each. Pull your free credit reports at AnnualCreditReport.com and look for accounts you didn't open. Watch for mail about accounts, tickets or claims that aren't yours. If you see actual misuse, file a police report; in Georgia, the Department of Driver Services can issue a new license number at a Customer Service Center.
Can I get a new Georgia driver's license number after a data breach?
Yes. Georgia DDS says license number changes must be requested in person at a DDS Customer Service Center, with your current license or identity documents. Standard fees apply. If your information has been misused, DDS asks you to file a police report and contact its Investigative Services Section. After a number change, update your car insurance, your bank and anywhere else that uses the number to identify you.
Is a credit freeze free, and will it hurt my credit?
Yes, it's free — federal law has required the three bureaus to offer free freezes and unfreezes since 2018 — and no, it does not affect your credit score. A freeze blocks new credit from being opened in your name until you lift it. You can temporarily lift it online in minutes when you apply for something yourself.
If my business scans IDs, what should I ask my vendor?
Four questions: What exactly do you keep after a scan — a pass/fail result, the license number, or the full image? How long is it kept, and can we shorten that? Where is it stored, and who at your company can reach it? And will you notify us within a set number of days if you have an incident? If the answers are vague, that's the answer.
About the author
Ricky Browning owns Browning PC, an IT services shop in Valdosta, Georgia serving homes and small businesses across Lowndes County and South Georgia — Hahira, Lake Park, Dasher, Adel, Moultrie and the surrounding area. He has been fixing computers, cleaning up after scams, and setting up networks for local families and business owners since 2023. More about Ricky · Get in touch