IDScan VeriScan breach linked to advertised collection of 153 million driving-licence scans
IDScan confirmed a VeriScan cloud breach linked to a service advertising 153 million licence records, not a confirmed victim count. People whose IDs were scanned by affected businesses should check notices and use the free identity protection offered.
If you receive a notice, or had your ID scanned at an affected business, call IDScan on +1-833-516-2980 to ask about your exposure and free identity protection. Monitor financial accounts and credit reports; US residents can place a credit freeze with Equifax, Experian and TransUnion. If your licence is being misused, contact its issuing authority.
What’s happening
IDScan confirmed unauthorised access to its VeriScan cloud platform. People can be affected through businesses that scanned their identification, without ever opening an IDScan account. Nexus advertised more than 153 million US and Canadian driving-licence records; KrebsOnSecurity verified samples, but the advertised total is not a confirmed count of affected people. eSecurity Planet later reported 13 million people affected, citing a Texas listing; IDScan’s public notice supplies no total. Harborside’s October customer notice confirmed potential exposure of ID photographs, signatures and scan-location information. Nexus going offline did not establish that stolen copies were recovered or deleted. As of 3 November, the latest company notice still described an ongoing investigation and no known misuse, while Canadian regulators had announced an investigation. This is a data breach with identity-protection measures, rather than a device update.
- What
- Breach
- Affects
- IDScan.net VeriScan cloud identity-verification platform
- Fixed in
- Nothing to patch
- Since
- 1 Sept 2026
- Closed
- 3 Oct 2026
Timeline
- Update
Harborside notified customers that VeriScan records could include ID images showing photographs and signatures, plus scan times and locations. It offered 12 months of IDScan-funded credit monitoring and identity protection.
- Vendor revised
IDScan updated its notice with the April–September access window and limited the incident to VeriScan. Potentially involved information includes names, contact details, birth dates and government identification numbers; its investigation remained ongoing.
- Update
eSecurity Planet reported 13 million affected people, citing a Texas breach listing. IDScan’s public notice gives no affected-person total, and neither figure confirms Nexus’s advertised document count.
- Update
Canada’s Privacy Commissioner opened an investigation into IDScan’s security safeguards and whether its notifications to affected people met Canadian privacy law.
- Update
BleepingComputer reported that IDScan was notifying potentially affected people and offering free identity protection. Nexus had gone offline; subsequent offers to sell the entire database remained unverified.
- Made public
IDScan first published its incident notice after learning of possible unauthorised access around 1 September. It says it secured systems and engaged outside investigators.
- Made public
KrebsOnSecurity reported that Nexus advertised more than 153 million US and Canadian driving-licence records, verified samples and linked several to businesses using IDScan. Krebs also reported that the FBI opened an investigation that day.
- UpdateNothing to patch
Unauthorised access to part of IDScan’s VeriScan cloud environment began, according to the company’s later investigation. The access period ended on 2 September.
Sources
- Notification of Data Security IncidentIDScan.net · 29 Sept 2026
- Notice of Data BreachHarborside · 3 Oct 2026
- Privacy Commissioner of Canada launches investigation into a data breach involving stolen identification detailsOffice of the Privacy Commissioner of Canada · 21 Sept 2026
- FBI Probes Service Selling 153M+ Drivers LicensesKrebsOnSecurity · 1 Sept 2026
- IDScan confirms breach tied to 153 million stolen driver’s licensesBleepingComputer · 10 Sept 2026
- IDScan Breach Filing: 13M People Affected After 153M-Record Dark Web ClaimeSecurity Planet · 28 Sept 2026