{"id":"idscan-identity-document-breach-sep-2026","category":"breach","status":"closed","title":"IDScan VeriScan breach linked to advertised collection of 153 million driving-licence scans","tldr":"IDScan confirmed a VeriScan cloud breach linked to a service advertising 153 million licence records, not a confirmed victim count. People whose IDs were scanned by affected businesses should check notices and use the free identity protection offered.","summary":"IDScan confirmed unauthorised access to its VeriScan cloud platform. People can be affected through businesses that scanned their identification, without ever opening an IDScan account. Nexus advertised more than 153 million US and Canadian driving-licence records; KrebsOnSecurity verified samples, but the advertised total is not a confirmed count of affected people. eSecurity Planet later reported 13 million people affected, citing a Texas listing; IDScan’s public notice supplies no total. Harborside’s October customer notice confirmed potential exposure of ID photographs, signatures and scan-location information. Nexus going offline did not establish that stolen copies were recovered or deleted. As of 3 November, the latest company notice still described an ongoing investigation and no known misuse, while Canadian regulators had announced an investigation. This is a data breach with identity-protection measures, rather than a device update.","action":"If you receive a notice, or had your ID scanned at an affected business, call IDScan on +1-833-516-2980 to ask about your exposure and free identity protection. Monitor financial accounts and credit reports; US residents can place a credit freeze with Equifax, Experian and TransUnion. If your licence is being misused, contact its issuing authority.","product":"IDScan.net VeriScan cloud identity-verification platform","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["idscan","veriscan","data-breach","identity-theft","driving-licence"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Notification of Data Security Incident","url":"https://idscan.net/notification-data-security-incident/","by":"IDScan.net","date":"2026-09-29"},{"kind":"advisory","title":"Notice of Data Breach","url":"https://www.shopharborside.com/notice-of-data-breach","by":"Harborside","date":"2026-10-03"},{"kind":"post","title":"Privacy Commissioner of Canada launches investigation into a data breach involving stolen identification details","url":"https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_260921/","by":"Office of the Privacy Commissioner of Canada","date":"2026-09-21"},{"kind":"news","title":"FBI Probes Service Selling 153M+ Drivers Licenses","url":"https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/","by":"KrebsOnSecurity","date":"2026-09-01"},{"kind":"news","title":"IDScan confirms breach tied to 153 million stolen driver’s licenses","url":"https://www.bleepingcomputer.com/news/security/idscan-confirms-breach-tied-to-153-million-stolen-drivers-licenses/","by":"BleepingComputer","date":"2026-09-10"},{"kind":"news","title":"IDScan Breach Filing: 13M People Affected After 153M-Record Dark Web Claim","url":"https://www.esecurityplanet.com/news/news-idscan-data-breach-13-million-people/","by":"eSecurity Planet","date":"2026-09-28"}],"started":"2026-09-01","closed":"2026-10-03","created":"2026-11-03T20:13:45.643Z","updated":"2026-11-03T20:13:45.643Z","cve_notes":[],"timeline":[{"at":"2026-10-03","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Harborside notified customers that VeriScan records could include ID images showing photographs and signatures, plus scan times and locations. It offered 12 months of IDScan-funded credit monitoring and identity protection.","url":"https://www.shopharborside.com/notice-of-data-breach","by":"Harborside","patch":null},{"at":"2026-09-29","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"IDScan updated its notice with the April–September access window and limited the incident to VeriScan. Potentially involved information includes names, contact details, birth dates and government identification numbers; its investigation remained ongoing.","url":"https://idscan.net/notification-data-security-incident/","by":"IDScan.net","patch":null},{"at":"2026-09-28","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"eSecurity Planet reported 13 million affected people, citing a Texas breach listing. IDScan’s public notice gives no affected-person total, and neither figure confirms Nexus’s advertised document count.","url":"https://www.esecurityplanet.com/news/news-idscan-data-breach-13-million-people/","by":"eSecurity Planet","patch":null},{"at":"2026-09-21","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Canada’s Privacy Commissioner opened an investigation into IDScan’s security safeguards and whether its notifications to affected people met Canadian privacy law.","url":"https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_260921/","by":"Office of the Privacy Commissioner of Canada","patch":null},{"at":"2026-09-10","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"BleepingComputer reported that IDScan was notifying potentially affected people and offering free identity protection. Nexus had gone offline; subsequent offers to sell the entire database remained unverified.","url":"https://www.bleepingcomputer.com/news/security/idscan-confirms-breach-tied-to-153-million-stolen-drivers-licenses/","by":"BleepingComputer","patch":null},{"at":"2026-09-04","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"IDScan first published its incident notice after learning of possible unauthorised access around 1 September. It says it secured systems and engaged outside investigators.","url":"https://idscan.net/notification-data-security-incident/","by":"IDScan.net","patch":null},{"at":"2026-09-01","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"KrebsOnSecurity reported that Nexus advertised more than 153 million US and Canadian driving-licence records, verified samples and linked several to businesses using IDScan. Krebs also reported that the FBI opened an investigation that day.","url":"https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/","by":"KrebsOnSecurity","patch":null},{"at":"2026-04-04","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Unauthorised access to part of IDScan’s VeriScan cloud environment began, according to the company’s later investigation. The access period ended on 2 September.","url":"https://idscan.net/notification-data-security-incident/","by":"IDScan.net","patch":"na"}],"url":"https://hard.fyi/live/idscan-identity-document-breach-sep-2026/","json":"https://hard.fyi/api/live?id=idscan-identity-document-breach-sep-2026"}