The 150 million license images are not a Florida DMV leak. Reporting by Krebs on Security and TechCrunch ties them to IDScan.net, a Louisiana company that scans IDs for businesses such as rental counters, age checks and dispensaries. IDScan has confirmed a breach, but not how many people it affects. Florida’s own driver database was breached the same month. That is a different break, with a different article.
What was being sold
On September 1, 2026, journalist Brian Krebs reported a dark-web shop he called Nexus. The sellers were advertising scans of more than 153 million driver’s licenses from the United States and Canada, plus other ID cards past 10 million, travel or international documents past 3 million, and medical cards, at least 579,000 of them. They talked about records on more than 170 million people. [1]
Those figures are the shop’s inventory, checked by a reporter against a sample. They are not a victim total signed by the company, and they are not a number Florida’s motor-vehicle office ever announced. [1] [4]
Krebs found his own Virginia license in the shop. The time on the file matched a trip he took in June 2025. People close to him who let him look also matched days they had traveled. Several of those days lined up with a Hertz rental counter, not with the airport security line. A family member’s file was seconds away from his, and both had handed licenses over at that same counter. One person in the check had not flown recently at all, and was in a long car rental. [1]
Why it pointed at a scanner, not a DMV
A security researcher, Zach Edwards, matched his file to a stop at Planet13, a Las Vegas dispensary, during a trip for the DEF CON conference. Of the places he had shown a license that day, he told Krebs the dispensary was the one that actually ran the card through a machine. Planet13 operates in several states, Florida included. Krebs reported that IDScan had announced an identity-checking deal covering the chain. [1]
The pictures were not a single snapshot. Krebs described his own record as several versions of the same card, including infrared and ultraviolet frames, the kind IDScan’s readers are built to take. Krebs noted that IDScan’s own documentation says its technology scans IDs with both infrared and ultraviolet light. [1]
Krebs wrote that IDScan’s own site listed customers including Hertz and Target, and that the company talks about doing more than 21 million checks a month at more than 20,000 locations. Treat a logo on a sales page as marketing until the business confirms it. Caesars Entertainment told Krebs it was not a client, had not used the company’s VeriScan product since February 2025, and had not told IDScan to keep old data. [1]
The same day the story ran, Krebs reported that the FBI’s New Orleans office had opened an investigation. That evening, he wrote, the shop replaced its login page with a note that the service was no longer available. Do not go hunting for a replacement. Sites that offer to “check if you are in it” are a second way to hand your name to a stranger. [1] [5]
What the company has actually said
IDScan posted its own notice on September 4, 2026. It said that around September 1 it learned someone may have gotten into data without permission. It said an outside party may have copied customer information stored in its cloud. The fields it names are full names and driver’s license or other government ID numbers. It did not publish a count of people. [2] [3]
The notice says “full access to the information required payment,” and that the company is warning people anyway and offering free credit monitoring. It also says it is cooperating with federal law enforcement. [2]
- Phone: 1-833-516-2980, weekdays, 8 a.m. to 8 p.m. Eastern. [2]
- Mail: 8814 Veterans Memorial Blvd, Suite 3-124, Metairie, LA 70003. [2] [3]
TechCrunch reported on September 10 that IDScan’s website talks about holding more than 150 million license records. Holding them and confirming they were all stolen are different sentences. The company still had not said how many individuals were affected. [4]
A photo is not a password
You hand a card to a clerk so they can see you are old enough, or that you match the name on a contract. You did not agree to build them a permanent infrared copy. Once that frame, the number, and your face are stored, you cannot rotate them the way you rotate a login. A scammer can use the set this month, and years later.
A Florida resident can be in this pile without having anything to do with the separate Florida DMV incident. Planet13 has a Florida location, and rental desks scan licenses every day. Being in the state file is the other incident. Being scanned at a counter is this one. You may not know which, if either, includes you. Act as if a copy exists. [1]
What you can still do
- Call the number above if a rental desk, hotel, bar, or dispensary ran your license through a scanner and you want the monitoring IDScan is offering. That line is not a Florida hotline. [2]
- Freeze credit at Equifax, Experian, and TransUnion. The FTC says it is free, does not change your score, and blocks new accounts until you lift it. A freeze is a harder door than a monitoring letter, which mostly tells you after an account already exists. [6] [8]
- Get an IRS Identity Protection PIN so a fake tax return in your name is easier for the agency to stop. [7]
- Prefer a look, not a scan. Ask the clerk to check the card and hand it back. When a form forces a photo, delete it from your camera roll, your email, and any cloud album when you are done.
- If you must send an ID picture, use Signal, then erase it on both ends. Keep passwords in Bitwarden, which publishes its code, not in a note on the phone. [9] [10]
You will not get a new face out of this. You can make the number harder to spend, and you can stop feeding scanners the next copy.
Sources
- [1] Krebs on Security, Sept. 1, 2026: FBI probes the license-scan shop
- [2] IDScan notice, Sept. 4, 2026: Notification of data security incident
- [3] Same notice, South Carolina filing: Consumer letter PDF
- [4] TechCrunch, Sept. 10, 2026: IDScan confirms a breach
- [5] NBC News, Sept. 11, 2026: FBI confirmed it is investigating the scanner breach
- [6] Federal Trade Commission: Credit freezes and fraud alerts
- [7] Internal Revenue Service: Get an Identity Protection PIN
- [8] Freeze a report: Equifax, Experian, TransUnion
- [9] Signal: signal.org
- [10] Bitwarden source code: github.com/bitwarden/clients
