Alleged IDScan.net data breach: Millions of drivers’ licenses are now for sale on the dark web

Digital scans of more than 153 million drivers’ licenses from people in the United States and Canada, along with millions of other identity and medical cards, are reportedly now for sale on the dark web, according to  Krebs on Security.

A new dark-web identity theft service, called Nexus, appears to have siphoned images from IDScan.net, a platform that specializes in in-person identity verification and serves businesses such as Hertz, FedEx, Target, and marijuana dispensaries.

While the number affected and scope of the incident remain unconfirmed, according to the report, compromised data includes photos of the front and back of licenses, as well as infrared and ultraviolet versions of the same images.

Here’s why this is so dangerous, and what you can do now to help protect yourself.

What the alleged IDScan data breach means for you

The data breach affects a historically large dataset, and if current speculation is confirmed, you could be at risk of identity theft if you submitted documents to IDScan.net or have done so through one of the services that was impacted.   IDScan has not officially confirmed this has happened, just that they are investigating.

“The breach of an identity verification company and subsequent sale of 153 million-plus drivers’ licenses on the dark web is one of the most significant identity-related incidents in recent memory,” said Ian Bednowitz, General Manager at LifeLock. 

Unlike breaches that impact usernames and passwords, this type of breach has the potential to be more harmful to the affected individuals.

“Drivers’ licenses are highly valuable to criminals, and the scale of this exposure makes the potential impact incredibly concerning,” Bednowitz explained. 

“Not only does this allow bad actors to verify accuracy of existing exposed personal information and fill in gaps from previous breaches, but it also connects that information to photographs and other personal information like height and weight.” 

Stolen driver's license data makes it easier for criminals to execute scams and identity theft. With your name, address, date of birth, email, and license details, a criminal has several details to personalize scams to make them more believable. And if your Social Security number was already exposed in a previous data breach, combining that information together gives identity thieves virtually everything needed to commit identity fraud.

In addition, while it’s relatively easy to change your password or cancel a credit card, this type of breach is much more difficult to recover from.

“You can’t easily change your driver’s license the way you can change a password or cancel a credit card,” Bednowitz said.

Identity theft is still a major threat

Identity theft is the No. 1 crime in America, and 1 in 4 Americans have been a victim of it, based on a 2025 survey conducted by Dynata on behalf of Gen. This number is likely to grow as technology advances.

“These incidents will keep coming, and will impact huge portions of the population, because AI continues to make it easier for cybercriminals to breach the defenses of companies that hold onto your personal information and data,” Bednowitz said.

What to do now to keep yourself safe

Because this breach is so widespread, if you think you could’ve been impacted, it’s important to take action today to protect yourself and your finances. And even if you’re not impacted by this breach, it’s still a good idea to make smart moves now. Bednowitz recommends the following steps to take after a data breach: 

• Put a freeze on your credit: A credit freeze helps stop lenders from opening new accounts in your name. You can lift it temporarily whenever you apply for credit yourself.
• Turn on dark web activity alerts and credit monitoring: Use a service like LifeLock to help scan breach dumps and dark web marketplaces for your personal details and notify you if your information shows up.
• Turn on multi-factor authentication on every account you can: MFA requires a code or approval on top of your password to log in. Start with your email, bank, and any account tied to your money or identity.
• Monitor your bank accounts with real scrutiny: Set up transaction alerts and read your statements line by line instead of skimming the balance. Small unfamiliar charges are often a test run before a bigger withdrawal, so report anything you don't recognize to your bank right away.

“The move here is to assume you’re one of the 153 million-plus impacted individuals,” Bednowitz said, “and do everything you can to prevent someone from using your identity.”

Products like LifeLock can help you monitor your identity with features that include dark web monitoring, breach alerts, and credit activity alerts, which are available through all membership plans. If your identity is stolen, LifeLock’s restoration specialists can also fix it on your behalf.

Identity theft isn’t going away today, but you can be better prepared for it.