IDScan.net confirms breach exposing more than 150 million driver's licenses

On 10 September 2026, IDScan.net — a Louisiana-based identity-verification company that processes ID checks for car rental firms, retailers and cannabis dispensaries — confirmed that attackers had stolen more than 150 million driver's license and ID records from its cloud systems. The stolen information included people's full names and driver's license numbers, along with identity numbers from other government-issued documents such as passports, and the photographs associated with the licenses.

The breach came to light on or around 1 September 2026, when security journalist Brian Krebs reported discovering a dark web site that allowed anyone to look up the driver's license information of more than 150 million people living in the United States and Canada. IDScan.net said it had received information that day indicating certain data may have been accessed without authorization, posted an acknowledgment on its website on 4 September, and issued its confirmation of the scale roughly a week later.

Federal scrutiny and high-profile victims

The scale and sensitivity of the trove drew immediate federal attention. The FBI confirmed it was investigating the incident, and the Pentagon said it was aware of the suspected breach; high-profile individuals reported to be among those affected included U.S. Secretary of Defense Pete Hegseth. Access to the full database was advertised for sale on the dark web behind a paywall.

Because government-issued identity documents cannot simply be reset like passwords, the exposure of more than 150 million license and passport records — complete with photographs — represents a durable identity-fraud risk for affected individuals across North America. With the investigation open and the data still circulating, the incident's status remained ongoing.