IDScan.net Breach Leaks 153 Million Driver License Scans to Nexus Dark Web Service

The breach exposed scans from an identity verification provider handling 21 million checks monthly across 20,000 locations for Fortune 500 clients in banking, retail, and law enforcement. Krebs confirmed samples including his own license and FBI agents' records matched IDScan.net output formats. The Nexus listing appeared simultaneously with forum promotion claiming 170 million records before the site vanished post-publication.

Evidence shows bulk exfiltration via service or API accounts rather than endpoint compromise, consistent with patterns in prior ID verification incidents where retention policies were absent. IDScan.net's contracts with clients lack mandated logging or deletion timelines, allowing persistent copies of sensitive biometrics and documents. Official statements remain silent on scope while the FBI investigation proceeds without public attribution.

This incident reveals systemic over-collection: organizations treat licenses as persistent proofs despite known compromise vectors in third-party verifiers. Contracts rarely enforce segregation or independent audits, enabling resale on dark web markets. Individuals face lifelong identity risks as scans circulate beyond initial collection points.

FBI probe and client notifications will test whether IDScan.net retained logs sufficient for tracing the actor. Expect regulatory pressure on retention limits and a shift toward non-scanned verification methods within 12 months.