By Paul Malie, Ed Racek, and Lance Bird
Alex Safyan, Contributor

On Sept. 1, cybersecurity journalist Brian Krebs reported that an identity theft service launched on the dark web, called Nexus, is selling scans of more than 153 million U.S. and Canadian driver’s licenses, over 10 million identification cards, and millions of travel and medical documents.

The data appears to have come from Louisiana-based identity verification company IDScan.net, which processes more than 21 million verifications monthly at over 20,000 worldwide locations for Hertz, Target, FedEx, Caesars Entertainment, and more than 1,000 marijuana dispensaries in 19 states.

Threat actors claim to have continuously exfiltrated IDScan.net data for more than a year, and the number of available records grows daily. The FBI’s New Orleans field office has opened an official investigation. IDScan.net initially acknowledged an internal investigation but made no public statement at the time of the original reporting.

On Sept. 4, IDScan.net published a formal notification of data security incident on its website. The notice stated, “On or around September 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization,” and the company “took immediate steps to secure [its] systems and engaged a team of third-party specialists to help determine the full nature and scope of the incident.”

The company acknowledged that “an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud,” specifying that affected data “may include full names and driver’s license or other government-issued identification numbers.” IDScan.net is offering affected individuals free credit monitoring and identity protection services and has confirmed cooperation with federal law enforcement.

So far, 17 putative class actions have been filed in the U.S. District Court for the Eastern District of Louisiana, with all complaints filed between Sept. 2 and Sept. 28.

Read the Law360 article below.