Quick Answer
IDScan.net is investigating an apparent exposure after the Nexus marketplace advertised more than 153 million U.S. and Canadian driver’s-license scans, while the FBI’s New Orleans office opened an inquiry. The advertised total is not a confirmed victim count, and Nexus has since disappeared. Treat unexpected identity-verification requests and account activity cautiously, preserve records, and follow updates from affected organizations.
Key Takeaways
- Nexus advertised more than 153 million U.S. and Canadian driver’s-license scans on September 1, 2026.
- The FBI’s New Orleans field office opened an inquiry into the apparent IDScan.net-related exposure.
- The 153 million figure is a marketplace claim, not a confirmed count of unique affected people.
- Some records reportedly included front, back, infrared, and ultraviolet images of identification documents.
- Nexus disappeared on September 2, 2026, but its removal does not establish that copies of the data were deleted.
What is known about the IDScan.net data breach investigation?
The FBI is investigating an apparent exposure connected to IDScan.net after the Nexus marketplace advertised more than 153 million U.S. and Canadian driver’s-license scans. The FBI’s New Orleans field office opened an official inquiry after the marketplace became public on September 1, 2026. The inquiry does not establish the source of every record or confirm that every advertised scan came from IDScan.net.
The IDScan.net data breach investigation remains a developing security matter because the marketplace claim is unusually large and the records described appear to be document images rather than only names or email addresses. The original investigation also described IDScan.net as a suspected source of the material and documented the FBI inquiry. IDScan.net marketing and operations leader Jillian Kossman said the company was investigating but could not provide additional information at that point.
The practical response is to avoid treating the reported scale as a final victim count. A marketplace can make claims that are incomplete, duplicated, or inaccurate, while an active investigation can take time to determine which records are authentic, where they originated, and whether an organization must notify affected people.
Why is IDScan.net connected to the Nexus marketplace claims?
IDScan.net is connected to the Nexus claims because the marketplace data was reported as apparently originating from an identity-authentication service provider, with IDScan.net identified as the suspected source. The available reporting does not establish a final technical cause, such as a direct compromise of IDScan.net systems, a third-party incident, or misuse at an individual customer location.
IDScan.net describes its business as identity verification technology used in settings that need to inspect physical IDs. The company said on May 28, 2025, that its technology handled more than 21 million verifications per month across more than 20,000 locations worldwide. IDScan.net’s 2025 disclosure also said the company analyzed more than 150 million ID scans during 2024.
The scale of those operations matters because identity-verification systems can handle sensitive document images during ordinary transactions, including travel and rental-car activity. A separate reported breach involving compromised account access shows why the source and access path matter: the harm, notification process, and safe response can differ substantially depending on whether data came from a vendor system, a customer account, or an outside application.
How large is the reported driver’s-license scan exposure?
The Nexus marketplace advertised more than 153 million driver’s-license scans, but that number is not a confirmed count of unique people affected by the apparent IDScan.net exposure. Nexus also claimed to hold records on more than 170 million people in North America, along with more than 10 million ID cards, more than 3 million travel documents or international IDs, and at least 579,000 medical cards.
The reported marketplace activity supplied some evidence of scale without independently validating every record. A blank Nexus search produced about 11.5 million result pages with roughly 15 records per page, a check that suggested a database of substantial size. The advertised driver’s-license total also rose by nearly 400,000 records in 24 hours, which indicated that new material could still have been added.
| Reported Nexus category | Advertised volume | What the figure means |
|---|---|---|
| U.S. and Canadian driver’s licenses | More than 153 million scans | A marketplace claim, not a confirmed unique-victim total. |
| North American people records | More than 170 million | A broader Nexus claim that may include overlapping document categories. |
| Other ID cards | More than 10 million | Marketplace-listed identification records outside the driver’s-license category. |
| Travel documents or international IDs | More than 3 million | Marketplace-listed travel or international identification records. |
| Medical cards | At least 579,000 | A separate sensitive-document category listed by Nexus. |
The most important limit is that a large marketplace listing does not prove that every entry is current, unique, complete, or traceable to one organization. Consumers should wait for verified notices from organizations that collected their ID, rather than assuming either that they are affected or that they are unaffected based on the advertised totals alone.
What information may have appeared in the ID scans?
Some of the records examined in the Nexus marketplace reportedly contained multiple images of the same identification document, including front, back, infrared, and ultraviolet scans. Document-image timestamps for nine people reportedly matched travel or rental-car activity, which supported the conclusion that at least some records were tied to real-world identity-verification transactions.
IDScan.net has publicly described using ultraviolet and infrared scans, hologram detection, and front-to-back ID cross-matching in its authentication system. Those methods are designed to help organizations evaluate whether an ID appears legitimate. At the same time, a collection of document images can be more sensitive than a basic contact-data list because it can include visual details that an organization uses during an identity check.
Consumers should not send a driver’s-license image, passport image, or medical card image in response to an unexpected email, text message, or phone call claiming to verify the breach. Save the message, use contact information from a known organization’s official account or statement, and ask the organization whether it has issued a notice. The same caution applies after incidents involving sensitive records exposure, where a public claim can create opportunities for impersonation attempts before facts are fully established.
Does the Nexus shutdown mean the reported data is gone?
The Nexus shutdown does not show that the reported identification data was deleted or can no longer be accessed by others. The marketplace disappeared shortly after the September 1 report, and its login screen was replaced on September 2 with a message saying the service was no longer available. The service’s disappearance only confirms that the public-facing Nexus site was no longer operating in the same form.
The distinction matters because data can be copied before a marketplace closes, and an investigation can continue after a visible service disappears. Consumers should not assume that the shutdown removes the need to review unusual account activity or preserve suspicious communications. Organizations connected to the records may provide more specific guidance as the inquiry establishes what happened.
The most sensible approach is to rely on direct notices from IDScan.net, a business where you presented an ID, or an agency with a verified role in the investigation. Do not rely on screenshots, forwarded social-media posts, or unsolicited breach-check services that request another copy of your identification document.
What should consumers do after the reported IDScan.net exposure?
Consumers should document suspicious activity, verify communications through known channels, and avoid giving new identity documents to anyone who contacts them about the reported exposure. The available information does not identify a confirmed list of affected individuals, so the immediate priority is reducing the risk of an impersonation attempt rather than responding to unverified claims.
- Save unexpected emails, texts, voicemails, and account alerts that mention IDScan.net, Nexus, a driver’s license, or identity verification.
- Check account activity through the official website or app you already use, rather than a link in an unexpected message.
- Contact a business directly if you recently presented an ID there and need to know whether it has issued a verified notice.
- Decline requests to upload a new driver’s-license scan unless you initiated contact through a known, legitimate service.
- Keep a dated record of suspicious contacts and transactions in case an affected organization, financial institution, or law-enforcement agency requests details.
Consumers should stop short of sending document photos, passwords, account codes, or financial information to a caller or sender who claims to be helping with the IDScan.net data breach. A similar concern arises in healthcare-related incidents such as third-party data theft, where uncertain early details can give scammers an opening to pose as a trusted company. Contact the organization through a verified official channel if a message appears urgent or asks for sensitive information.
What questions remain in the FBI’s IDScan.net inquiry?
The FBI inquiry has not yet established the technical source of the records, the number of unique people affected, or whether all of the Nexus listings were authentic and current. Those unanswered questions are central because they determine who must be notified, what information may be at risk, and whether affected individuals need more specific protective steps.
IDScan.net’s reported response was limited to confirming that the company was investigating and could not share additional information. An independent account also described the data as suspected to have come from an ID authentication provider, rather than presenting a final attribution. Independent reporting on the investigation similarly described the connection as suspected.
For most people, the practical next step is patience combined with careful verification. Watch for a direct notice from a business where you provided an ID, keep records of suspicious contacts, and avoid sharing new identity documents in response to a message that has not been independently verified.
FAQ
Was IDScan.net hacked?
IDScan.net has not publicly confirmed a final cause or described a confirmed hack in the available information. The company said it was investigating after Nexus advertised the records, while the FBI opened an inquiry into the apparent exposure.
How many people were affected by the IDScan.net data breach?
The number of people affected is not confirmed. Nexus advertised more than 153 million U.S. and Canadian driver’s-license scans and claimed records on more than 170 million people, but those marketplace figures are not verified unique-victim counts.
What kinds of documents did Nexus claim to have?
Nexus claimed to offer driver’s licenses, other ID cards, travel documents or international IDs, and medical cards. Some records reportedly included front, back, infrared, and ultraviolet images of identification documents.
Should I replace my driver’s license because of the reported exposure?
A reported Nexus listing alone does not establish that your driver’s license was involved or that replacement is necessary. Contact the relevant issuing agency or a business that provided a verified breach notice before taking document-replacement steps.
Is Nexus still available?
Nexus was no longer available in its reported form as of September 2, 2026. The marketplace’s disappearance does not establish that copies of the reported data were deleted or unavailable elsewhere.