Half a million driver's licenses left IDScan every day. Nobody was watching the door.

On 2 September 2026, Krebs reported that Nexus was offering search access to identity documents belonging to more than 150 million people across the United States and Canada. Working with security researcher Zach Edwards, Krebs traced the source to IDScan, a Louisiana based company relied on by major consumer brands to verify tens of millions of identity documents each month. Eight days later, on 10 September, IDScan confirmed in a notice posted to its own website that an unauthorised party had accessed data stored in its cloud environment. The company has not disputed that IDScan is the source Krebs identified.

The scale of the access is what sets this apart from an ordinary stolen database. An advert for Nexus on a Russian language cybercrime forum said the site was adding around half a million new identity documents daily, a detail that points to something closer to a live feed into IDScan's systems than a single historical export. Krebs confirmed his own driver's licence was searchable on the site, photograph included. So was a record belonging to the United States Secretary of Defense, Pete Hegseth, and one belonging to Edwards himself. Nexus went offline within hours of Krebs's report, though nothing published so far shows that the underlying access into IDScan's systems was identified or closed at the same time.

IDScan has not disclosed how the intrusion began, how long it ran before Krebs found it, or which of its systems allowed data to be pulled at that rate. The company said only that its investigation was ongoing and that a third party may have accessed or copied information stored in customer accounts on its cloud platform. The FBI's New Orleans field office and the US Department of Defense are both reported to be looking into the incident.

By TechCrunch's own description, this would be the largest known single breach of identity documents in some time, and it lands as governments across multiple countries expand age verification and know-your-customer rules that push more people to hand government issued IDs to more third parties. Every verification vendor is a fresh concentration point: one breach here does not expose one company's customers, it exposes everyone who ever verified their identity through any of that vendor's clients.

IDScan's failure was not a careless one by ordinary standards. It is a company built to handle sensitive identity data at scale for security conscious clients. What was missing was not a firewall or a password policy but a control over the one action that actually mattered: a sustained, high volume extraction of records from a system that normally processes one verification check at a time. A credential or service account with legitimate access to that database can be made to behave nothing like the humans it was built for, and once something can pull half a million records a day, no perimeter matters if nothing gates the pull itself.

A bulk export or a sustained, high volume pull from an identity document store is an execution event, not background noise. Before any export or API level query above an ordinary daily threshold can complete, GoFirm sends a real time confirmation request to the client's named data protection officer or security lead, on their registered device, stating what is being pulled, from which system, and at what volume. Only a biometric confirmation on that specific device allows the export to proceed. Without it, the export is blocked automatically, regardless of which credentials or service accounts requested it.

A compromised service account, a stolen API key, or an attacker with a quiet, long-running foothold inside a cloud environment cannot produce that confirmation. It makes no difference how long the access has gone unnoticed or how closely the traffic resembles normal use. The execution boundary holds regardless of how deeply an attacker has already got in.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. Whittaker, Z. 2026. It sure looks like hackers breached a major ID card verification service. TechCrunch, 2 September 2026.
2. Whittaker, Z. 2026. ID verification giant IDScan confirms data breach with more than 150 million driver's licenses stolen. TechCrunch, 10 September 2026.
3. Krebs, B. 2026. FBI probes service selling 153M driver's licenses. KrebsOnSecurity, 2 September 2026.
4. Bartram, N. 2026. Data Breach Roundup (Sep 4 - 10, 2026). Privacy Guides, 11 September 2026.