Markets
IDScan.net Breach Put 153M Driver's License Scans on a Dark Web Store, With Live Exfiltration Running for Over a Year
Brian Krebs reported and the FBI confirmed on 2026-09-02 that more than 153 million US and Canadian driver's license scans attributed to identity-verification vendor IDScan.net went up for sale on a dark web service called Nexus, alongside 10 million ID cards, 3 million travel cards and 579,000 medical cards. Techdirt reports the attackers held a live feed for over a year, with roughly 400,000 new records added within 24 hours of public disclosure; named IDScan customers include Hertz, FedEx, Target and thousands of cannabis dispensaries. This is the failure mode of outsourced KYC-as-a-service: every downstream SaaS that bolted on a verification vendor inherited a year-long real-time leak it had no visibility into.
↳ Follow the thread