01 / THE FACTSWhat happened, as far as anyone has said
On August 31, 2026, a service calling itself Nexus went up for sale on a Russian-language cybercrime forum, advertising searchable access to scanned identity documents for more than 170 million people in North America. Brian Krebs, who broke the story on September 1, reported the inventory the operators claimed: more than 153 million U.S. and Canadian driver’s licenses, more than 10 million identification cards, more than 3 million travel documents, and roughly 579,000 medical cards, with each license record carrying several images of the front and back, including infrared and ultraviolet captures of the kind produced by document-authentication scanners. The count was growing while he watched it. Most of the records were for U.S. residents; roughly 1.1 million were Canadian licenses. For scale on the pipe those images travel through: IDScan has reported scanning 150 million IDs in 2024 alone.
The trail pointed at IDScan.net, a Louisiana-based identity-verification company whose technology, by its own description, performs more than 21 million verifications a month at more than 20,000 locations. Krebs matched sample records to the moments people had handed licenses across a rental-car counter and to a visit to a dispensary chain that publicly uses IDScan’s verification. The FBI’s New Orleans field office confirmed an investigation. The Nexus site disappeared on September 2. Lawsuits were filed in Louisiana within the week.
IDScan’s notice, published September 4, says that “on or around September 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization,” and that the company “took immediate steps to secure our systems and engaged a team of third-party specialists to help determine the full nature and scope” of the incident. It says an unauthorized third party “may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud,” that the affected data “may include full names and driver’s license or other government-issued identification numbers,” and that although “full access to the information required payment,” the company is notifying potentially affected individuals and offering credit monitoring. It says it is cooperating with federal law enforcement. It has not said how the intrusion happened, how long the access lasted, or how many of its business customers are affected. The criminals’ own claim, that they had been pulling data continuously for more than a year, is a claim from criminals and should be read that way.
One caution belongs with those facts, because it will matter to readers who recognize their own vendor list. Appearing on an identity-verification company’s published customer roster is not the same as having been exposed. Businesses buy hardware without the cloud service, run deployments that never transmit images, or use an unrelated product line — in this incident at least one large retailer named on the vendor’s site publicly stated that it uses only the hardware, did not transmit customer data, and had none in the breach. The reporting connected specific records to specific counters; it did not establish that every named customer was affected, and neither does this brief.
That is the factual record as of this writing. Everything below is analysis.
02 / THE REAL FAILUREVerification takes seconds. The copy lived on.
Strip away the dark-web theater and the story is about one decision that most of the businesses involved never consciously made. An ID scanner at a counter exists to answer a question in real time: is this document authentic, and does the person meet the age or identity requirement? That answer is a boolean plus, at most, a few fields. Once it is delivered, the image of the license has done its job.
Somewhere in the chain, the image was kept anyway. Whether the retention was IDScan’s default, a setting its business customers chose, a regulatory record-keeping requirement in certain industries, or all three is not yet public and will probably vary by customer. What is public is the result: a repository of scanned government identity documents large enough that a criminal marketplace could offer it as a search service. The breach was the delivery mechanism. The retention was the exposure.
This is not a novel principle. Data minimization and storage limitation are named requirements under the GDPR (the GDPR field guide covers how they reach disposal), and most U.S. states have data-disposal statutes requiring that records containing personal information be destroyed when they are no longer needed (the Compliance Map shows the state pattern). The FTC has for years treated holding sensitive data longer than a business purpose requires as a factor in whether security was reasonable. None of that is new. What the IDScan incident supplies is the scale: a single vendor, thousands of counters, and a number with nine digits in it.
03 / THE SAME PROBLEM, DIFFERENT PLACEWhy this is an ITAD story
CyberCrunch does not do identity verification, and this brief is not a claim that we could have prevented anything. It is an observation that the failure mode is the one our industry is organized around. IT asset disposition exists because organizations retire hardware without knowing what is still on it: the laptop in the closet with the tax records, the copier drive with a year of scanned documents, the server that was “wiped” by a format command. The IDScan story is that failure relocated from a hard drive to a vendor’s cloud: data that outlived its purpose, in a place nobody was tracking, discovered only when someone else found it first.
It also has a literal hardware dimension that will get less attention than the cloud. The scanners, kiosks, handheld readers, point-of-sale tablets, and back-office servers that feed a verification service frequently cache images, extracted fields, and transaction logs locally. When a bar replaces its door scanners, a dispensary refreshes its POS tablets, or a rental company swaps out counter hardware, those devices are usually retired as peripherals, on a pallet with the monitors, and never as data-bearing media. The Copier Went Home is the same story on a different device. A retired ID scanner that goes to a free scrap hauler is a small, local version of what just happened at scale.
The discipline that fixes both is one discipline. Know where personal data lives, including in vendors and in devices you think of as appliances. Decide how long it needs to exist and enforce that. When it reaches end of life, whether that is a retention date in a cloud or a retirement date for a device, destroy it in a way you can prove, by serial, with a certificate. The Data Destruction Field Manual covers the media side; the rest of this brief covers the vendor side.
04 / FIVE ACTIONSWhat a business that scans IDs should do this week
If your organization scans customer identification for any reason, the IDScan incident is a reason to do the following now, whether or not you use IDScan.
- Find out what your vendor retains, and for how long. Ask in writing: does the service store the document image after verification? Which extracted fields? For how long? Who can configure that? Where is it stored, and who else has access? If the answer is that images are kept indefinitely by default, that default is now your exposure.
- Request deletion, and get it in writing. Where no law requires you to keep scans, ask the vendor to purge historical images and to set retention to the minimum your business purpose supports. Where a regulation does require a record (some cannabis and firearms rules do), retain the minimum fields, not the image, and confirm what the rule actually demands rather than assuming it wants a picture.
- Check your own notification obligations. A driver’s license number with a name is a covered data element under state breach-notification statutes as a general pattern, and the duty to notify individuals usually sits with the business that owns or licenses the data, not the vendor that stored it. If you are an IDScan customer, find out which of your records were affected and review your state’s timeline; the Mid-Atlantic recap covers four states’ rules side by side. This is not legal advice; involve counsel.
- Put retention, deletion, and liability into the contract. Retention limits with a deletion certificate on request; a breach-notice window measured in days; the vendor’s security certifications and your right to see the reports; and insurance that actually reaches a vendor-caused incident, which, as The Coverage Gap explains, means technology errors and omissions coverage with you named as additional insured, not a certificate of general liability.
- Treat the scanning hardware as data-bearing at retirement. Door scanners, kiosks, POS tablets, handheld readers, and the servers behind them go on the ITAD inventory by serial, are sanitized or destroyed under NIST SP 800-88 with a certificate each, and never leave on the general recycling pallet. If your ITAD program does not currently know these devices exist, that is the first fix.
05 / IF IT WAS YOUR LICENSEFor the people on the other side of the counter
Most readers of this hub are the businesses. But 153 million is a large enough number that it includes a good share of them personally, so briefly: a license scan cannot be reset the way a password can. The image carries your name, number, address, date of birth, and photograph, and it stays valid as a template for fraud for as long as those facts are true. Freeze your credit at all three bureaus, which is free and reversible; set fraud alerts; watch for accounts and inquiries you did not initiate; and be skeptical of any message that references the breach and asks you to click or call. Some states will issue a replacement license with a new number on request or with a police report, which blunts number-based fraud even though it cannot recall the image. IDScan has said it will notify the people it identifies as affected and provide access to free credit monitoring and identity protection services, with enrollment through a dedicated line (1-833-516-2980, Monday through Friday, 8 a.m. to 8 p.m. Eastern) listed in its notice. As always with a breach this widely reported, the scammers will be calling too: initiate that contact yourself from the company’s own published notice rather than from a message that arrives asking you to enroll.
The retention question is not confined to vendors that hold your records. It also applies to the connected devices sitting in your own building — the smart TV listening brief covers what televisions, speakers, and cameras keep in embedded flash, and why a factory reset does not reach it.
06 / FAQIDScan breach FAQ
How did the IDScan breach actually happen?
As of mid-September 2026, IDScan had not said. Its September 4 notice states that “on or around September 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization,” that it “took immediate steps to secure our systems and engaged a team of third-party specialists,” and that an unauthorized third party may have accessed or copied customer information stored within customer accounts on the IDScan.net cloud. The criminals behind the Nexus marketplace claimed to have been exfiltrating data continuously for more than a year, a claim that has not been independently confirmed. Whether the entry point was stolen credentials, an exposed storage interface, or something else will likely emerge through the FBI investigation and the litigation. What is already clear is that the scans existed to be stolen, which is the part any business can act on now.
Is a driver's license number 'personal information' under breach-notification laws?
Yes, as a general pattern. State breach-notification statutes define the personal information that triggers a notice duty, and a driver's license or state identification number combined with a name is a covered element in the statutes we are aware of, alongside Social Security numbers and financial account numbers. Timelines, thresholds, and who must be notified (individuals, the attorney general, credit bureaus) vary by state; the Compliance Map and the Mid-Atlantic recap on this hub cover the state-by-state pattern. Because a scanned license image typically contains the name, the number, the address, and the date of birth together, a stolen scan is close to the worst case those statutes contemplate. This is not legal advice; confirm your obligations with counsel.
Our company appears on that vendor's customer list. Does that mean our customers' data was taken?
Not necessarily, and it is worth establishing before anyone assumes otherwise. A vendor's public customer list reflects who buys something from it, which can mean hardware only, a different product line, or an on-premises deployment that never sends images to the vendor's cloud. In this incident at least one large retailer named on the vendor's site publicly stated that it uses only the hardware, did not transmit customer data to the vendor, and had no customer data in the breach. The way to answer the question for your own organization is in writing to the vendor: which of our records, from which locations and which date range, were in the affected systems, and what is your evidence? Ask the same question even if you believe your deployment is local, because configurations drift and integrations get added.
Our business uses an ID scanner. Are we responsible for notifying our customers about a vendor's breach?
It depends on the statute and on the contract, but the general pattern in state law is that the business that owns or licenses the personal information carries the notice duty to individuals, while a vendor that maintains the data on the business's behalf must notify the business. In practice that means a bar, dispensary, or rental counter whose customers' scans were held by a vendor should be asking the vendor, in writing, which of its records were affected, and should be reviewing its own state's requirements rather than assuming the vendor's notice discharges them. Many businesses will find that the retention setting that created the exposure was a configuration choice they never made deliberately. This is not legal advice.
Can a stolen driver's license scan be reset the way a password can?
No. A password is replaced in a minute; a license image with your name, number, address, date of birth, and photograph is a durable identity document. Some states will issue a replacement license with a new number on request or with a police report, which helps against number-based fraud but does not recall the image. The practical defenses are a credit freeze at the three bureaus, fraud alerts, monitoring for new accounts, and heightened skepticism toward messages that reference the breach. For the businesses involved, this is the argument for not keeping the image at all: what does not exist cannot be reset because it does not need to be.
What does a vendor cloud breach have to do with IT asset disposition?
The same inventory question. ITAD exists because organizations retire hardware without knowing what data is still on it, and the IDScan incident is that problem in a different place: data that outlived its purpose, in a location nobody was tracking. The scanners, kiosks, tablets, and back-office servers that feed a verification service often cache the same images and logs locally, and they are retired as peripherals rather than as data-bearing devices. A program that already maps where personal data lives, sets retention, and destroys media by serial at end of life is the same program that catches an over-retaining vendor. It is one discipline applied in two places.
KNOW WHERE THE DATA LIVES
Retire the devices that scanned it the right way
Scanners, kiosks, tablets, copiers, and servers all leave with data on them. CyberCrunch inventories them by serial, sanitizes or destroys the media under NIST SP 800-88, and returns a certificate for each — NAID AAA, R2v3, RIOS, and PA DEP certified, on-site or at our facility, in all 50 states.
This brief is a news analysis reflecting public reporting as of September 18, 2026 — Krebs on Security (September 1), BleepingComputer (September 4 and 10), TechCrunch and The Record (September 10), CNET (September 11), and IDScan.net’s published security notice (September 4) — and the facts may change as the investigation and litigation proceed. Claims attributed to the criminal operators are reported as claims, not findings. CyberCrunch has no relationship with IDScan.net or the businesses named in the reporting and makes no allegation about any party’s conduct. Descriptions of breach-notification and data-disposal law are pattern-level and are not legal advice; obligations depend on your state and your contracts, so confirm them with qualified counsel.