[REVISION HISTORY]

North American driver's license data breach

Updated 8 times since CLSTR started tracking revisions of this situation.

What changed

2026-09-22 18:05 UTC → 2026-09-26 10:41 UTC · added ~~removed~~

A massive data breach involving the dark web marketplace Nexus has exposed approximately 170 million identity records. The leaked trove includes over 153 million driver’s licenses from the United States and Canada, 10 million other forms of identification, 3 million travel documents, and at least 579,000 medical cards. Cybersecurity journalist Brian Krebs confirmed the authenticity of the data after criminals provided a copy of his own driver’s license as proof. The breach also includes sensitive identification for high-profile figures, such as U.S. Defense Secretary Pete Hegseth and an assistant director of the FBI. IDScan, a Louisiana-based identity verification technology company used by services such as Hertz, has confirmed the breach. The company stated the incident went undetected for roughly one year and targeted its cloud infrastructure. IDScan serves various sectors, including hospitality, car rentals, and cannabis dispensaries, with a client list including Target and Caesars Entertainment. The FBI’s New Orleans field office and the Pentagon have acknowledged the incident. In response, the Office of the Privacy Commissioner of Canada (OPC) has launched an investigation to determine if IDScan.net complied with the Personal Information Protection and Electronic Documents Act (PIPEDA). Privacy Commissioner Philippe Dufresne is examining whether the company’s security safeguards were ~~adequate. The RCMP is also monitoring the situation in collaboration~~ adequate, its notification processes, and its compliance with ~~international law enforcement.~~ federal privacy legislation. Experts warn that because the breach involves sensitive digital copies—including full names, dates of birth, addresses, signatures, and license numbers—the stolen details cannot be easily replaced, significantly increasing the risk of identity theft, fraudulent account openings, and phone number hijacking. IDScan has indicated it is working with external experts and will provide credit monitoring and identity theft protection services to those affected. The company is currently facing multiple class-action lawsuits.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.