IDScan confirms a breach as a seller claims 153 million licenses

The company behind many of the ID scanners at venue doors and dispensary counters has confirmed a breach. It has not said how big it is. The biggest number in circulation comes from the people selling the data.

What IDScan confirmed

IDScan is a Louisiana-based identity verification company. Its scanners are used by businesses from entertainment venues to cannabis dispensaries to check customers’ documents. In a September 4, 2026 security notice, the company said “an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud,” including “full names and driver’s license or other government-issued identification numbers.”

The company said it learned of the incident on or around September 1. It has not said how many people are affected. TechCrunch and BleepingComputer reported the confirmation on September 10, and Krebs on Security reports that the FBI is investigating.

Where the 153 million figure comes from

The scale comes from the other side. A dark-web service called Nexus claimed to hold more than 153 million driver’s licenses belonging to people in the United States and Canada, and offered searches of that data before the site went offline. IDScan’s own website says it holds over 150 million driver’s license records. Neither figure is a confirmed count of affected people.

What it means for people who were scanned

ID checks at the door are routine, and most people never ask what happens to the scan afterwards. A scan at a venue or a rental desk can leave a copy that the customer does not control. A full name combined with a license number is enough to start many identity fraud attempts.

People who have had a license scanned at a business that uses IDScan can check their credit reports, consider a credit freeze, and treat any unexpected message that mentions their license number with suspicion until the company says more about who was affected.