Think about the last time somebody scanned your driver’s license. Not glanced at it. Scanned it with a little handheld gadget or a tablet at the bar, the car rental desk, the bank branch, the hotel, maybe a dispensary.
You assumed the scan checked your age or your identity and then vanished. It didn’t. Somebody kept it. And now, security researchers say, more than 153 million of those scans are in the hands of criminals.
I’ve been a consumer reporter for more than 35 years, and I’ve covered every big breach from Equifax on down. This one is different, because the company that lost your data is one you never did business with.
Here’s what happened, what a thief can do with a license, and the fixes that don’t cost a dime.
What happened
On Sept. 1, security journalist Brian Krebs reported that a new service on a Russian-language crime forum, calling itself Nexus, was advertising a searchable database of more than 153 million U.S. and Canadian driver’s license scans.
The listing also claimed roughly 10 million ID cards, 3 travel documents and international IDs, and 579,000 medical cards.
Krebs found his own license in it: front and back, including infrared and ultraviolet images, with timestamps matching a trip he’d taken in June 2025. Nine acquaintances confirmed their scans matched dates they’d rented cars or traveled.
The trail led to IDScan.net, a New Orleans-area company that sells ID-scanning software to car-rental companies, retailers, banks, casinos, hotels, gun shops, bars and more than a thousand cannabis dispensaries. Krebs reported the company’s website had claimed more than 21 million verifications a month at more than 20,000 locations.
On Sept. 4, IDScan posted a notice saying an unauthorized party “may have accessed and/or copied certain customer information” stored in its cloud, including “full names and driver’s license or other government-issued identification numbers.”
The FBI’s New Orleans office is investigating. At least four class-action lawsuits have been filed in federal court in Louisiana, naming Hertz among the clients whose customers were exposed.
The Nexus site went dark Sept. 2. The data didn’t. As Krebs told Time, this data set will keep its “massive value to the cybercriminal community for many years.”
What IDScan isn’t telling you
The company hasn’t said how many people are affected. It hasn’t confirmed that images, as opposed to names and numbers, were taken. And there’s no website where you can type in your name and find out whether you’re in it.
IDScan says it will contact affected people directly. If you rented a car, checked into a hotel or bought a drink at a place that scanned your license in the last several years, you should assume you might be.
For scale: The 2017 Equifax breach, which led to a settlement of up to $700 million, exposed about 147 million people.
Why a license number is worse than a card number
When a credit card number leaks, the bank cancels it and mails you a new one. Your driver’s license number is different.
Most states won’t issue a new number just because it appeared in a breach. Colorado’s DMV, for example, told Equifax victims they were “not eligible to have their driver license number changed” without documented fraud and a police report.
So the number sticks with you. And here’s what a thief can do with it, according to the Identity Theft Resource Center and Experian:
- Open bank and credit accounts, because a license is the standard proof of identity.
- Print a convincing fake ID with your name and number on it, then use it to rent cars, cash checks or give a police officer your identity at a traffic stop.
- File a change-of-address with the post office to redirect your mail.
- Build a synthetic identity, which the Federal Reserve describes as a blend of real and fictional information that can take years to detect.
If the scans included your photo, add facial-recognition matching to the list.
None of that requires your Social Security number. Your license, your name and your birth date are enough to get started.
A quick nudge — when it comes to money, the best day to get smart was 20 years ago. The second-best is today. Sign up for the free Money Talks Newsletter and start now. Takes 10 seconds, costs nothing, and could change your retirement.
7 free moves to make this week
Every one of these is free. If someone tries to sell you protection after a breach, that’s your cue to hang up.
1. Freeze your credit at all three bureaus. A freeze blocks new accounts in your name. Since 2018, federal law has required Equifax, Experian and TransUnion to place and lift freezes for free, and to lift them within an hour when you ask online or by phone.
You have to contact each bureau separately. We’ve written a step-by-step guide.
2. Freeze the two bureaus nobody mentions. Banks check ChexSystems before opening a checking account, and phone, cable and utility companies check the National Consumer Telecom and Utilities Exchange. A thief with your license can open both kinds of account. Both offer free freezes online or by phone.
3. Get an IRS identity protection personal identification number (IP PIN). A stolen identity is often used to file a fake tax return and grab your refund. The six-digit IP PIN stops that; anyone with a Social Security number can get one, fastest through an IRS online account.
4. Take IDScan’s free monitoring. The company is offering free credit monitoring and identity protection to affected people. Call 1-833-516-2980, Monday through Friday, 8 a.m. to 8 p.m. Eastern. Expect a wait.
5. Pull your driving record and flag your license. Ask your state motor vehicle agency for a copy of your driving record and check for tickets you didn’t get. Some states, like Vermont, will mark your record as compromised if you send them the breach notice. Ask yours what it offers.
6. Check your credit reports weekly, for free. The bureaus made weekly free reports at AnnualCreditReport.com permanent. Set a reminder and look for accounts and addresses you don’t recognize.
7. Sign up for USPS Informed Delivery. It’s free and emails you images of the mail headed to your box each day. If a thief redirects your mail or a new credit card you didn’t order is on its way, you’ll know.
The system that put you here
You didn’t choose IDScan. The bar did. The rental counter did. And in most states, nothing stopped them from keeping your scan indefinitely.
Only about 17 states limit how businesses can scan and store license data, according to the ACLU. California bars retailers from retaining it beyond a handful of narrow purposes. Texas prohibits building databases of license data at all. Most of the country has no rule.
So the next time someone reaches for the scanner, ask a question I’ve started asking: Do you need to scan it, or can you just look at it?
Plenty of places will take a look. The ones that insist on scanning should be able to tell you how long they keep it and why.
You can’t unbreach a database. But you can make the information in it a lot less useful, and you can start this afternoon. If you want to go further than a freeze, we’ve laid out the next layer of defenses too.
Add a Comment