153 Million Drivers Licenses Exposed Implications Of The Idscan Net Breach For Businesses Using Third Party Identity Verification Vendors

On September 1, 2026, cybersecurity journalist Brian Krebs reported that dark-web identity-theft service “Nexus” is selling scans of more than 153 million U.S. and Canadian driver’s licenses, over 10 million identification cards, and millions of travel and medical documents. The data appears to come from Louisiana-based identity-verification company idscan.net, which processes more than 21 million verifications monthly at over 20,000 worldwide locations for Hertz, Target, FedEx, Caesars Entertainment, and more than 1,000 marijuana dispensaries in 19 states.

Threat actors claim to have continuously exfiltrated idscan.net data for more than a year; available records grow daily. The FBI’s New Orleans field office has opened an official investigation. Idscan.net acknowledges an internal investigation but has made no public statement.

Exposed records include high-resolution front-and-back driver’s-license scans, including infrared and ultraviolet images, timestamped to ID presentations at Hertz rental counters, Planet13 dispensaries, and other client locations. They contain names, photographs, addresses, birth dates, license numbers, and sometimes medical cards and government-issued Common Access Cards.

The exposure of records could have detrimental consequences. Driver’s licenses are primary authentication credentials for opening credit lines, accessing government services, and verifying identity in countless transactions. Security researchers warn of acute risks to domestic violence survivors, federal witness-protection participants, and anyone whose physical safety depends on remaining unlocated. Infrared and ultraviolet scans make the documents especially dangerous for synthetic identity fraud and deepfake-enabled impersonation.

Businesses contracting with idscan.net to verify customer identities are not bystanders. Under the increasingly developed U.S. state consumer privacy framework, they may face direct regulatory enforcement and litigation exposure as data controllers responsible for securing personal data they collected, even though a third-party processor was the failure point.

The CCPA/CPRA. California’s private right of action for data breaches (Cal. Civ. Code § 1798.150) permits consumers to seek statutory damages of $107 to $799 per consumer per incident when a breach results from a business’s failure to maintain reasonable security procedures. Liability could fall on the business, making the controller the primary litigation target. The California AG and California Privacy Protection Agency may also seek civil penalties up to $7,988 per intentional violation; each affected consumer is a separate violation. For 153 million records, the potential aggregate exposure is enormous.

State Consumer Data Privacy Laws. Across the growing patchwork of state consumer privacy statutes now in force, including Virginia, Colorado, Connecticut, Texas, Oregon, Montana, New Jersey, Delaware, Indiana, Kentucky, Minnesota, Nebraska, Rhode Island, Alabama, and others, a consistent framework has emerged. These laws uniformly require controllers to execute written data processing agreements with processors that include security provisions, audit and assessment rights, breach-notification assistance, and data return or deletion requirements. Critically, virtually all provide that the processing contract “cannot relieve a controller or processor from liabilities imposed on them by virtue of its role in the processing relationship.” Civil penalties range from $7,500 to $50,000 per violation and are enforced by state attorneys general.

Federal Exposure. The FTC has previously found that entrusting sensitive consumer data to a vendor without adequate oversight is an unfair practice under Section 5 of the FTC Act. European regulators may also assert jurisdiction over EU or UK data subjects whose records are among the stolen data under GDPR’s controller-liability framework. Recent European case law, including the German Federal Court of Justice’s ruling in the Deezer data leak, confirms that controllers are independently liable for failing to monitor processors, even where an outside attacker was the proximate cause of the breach, and that publishing stolen data on the dark web “almost inevitably” constitutes compensable harm.

Litigation Risk. Class actions under the CCPA’s private right of action for data breaches are virtually certain. Common-law negligence, breach-of-contract, and state consumer-protection claims are also likely, particularly from individuals suffering identity theft or financial fraud. Idscan.net’s public list of major clients may make it difficult for controllers to distance themselves from the incident.

Audit Vendor Agreements Immediately. Review every data processing agreement with identity-verification vendors and other processors handling sensitive personal data. Confirm that each contract includes provisions required under applicable state privacy laws, such as security obligations, breach-notification timelines, audit and assessment rights, sub-processor restrictions, and data return or deletion upon termination. Agreements predating the current wave of state privacy legislation may be inadequate.

Move Beyond Paper Compliance to Active Monitoring. A signed data protection assessment may no longer suffice. Regulators and courts are increasingly requiring controllers to show that they exercised audit rights and monitored processor security on an ongoing basis. Implement a vendor risk management program with periodic security assessments, penetration-testing requirements, SOC 2 or equivalent audit-report reviews, and documented evidence of compliance verification. The idscan.net breach, where exfiltration reportedly continued undetected for over a year, demonstrates the risk to controllers where processor security is inadequate.

Conduct a Data Protection Assessment for High-Risk Processing. Nearly every comprehensive state privacy law now requires a data protection assessment before processing activities that present heightened consumer-harm risk. Identity verification involving government-issued identification documents almost certainly qualifies. Ensure your organization has conducted and documented these assessments, including evaluation of the processor’s security measures and the residual risk of entrusting sensitive data to a third party.

Prepare an Incident Response Playbook for Processor Breaches. Do not wait for vendor notice. Require immediate breach notification by contract, maintain an updated inventory of data each processor holds for you, and ensure your incident response plan covers situations where you (as the controller) must notify regulators and affected individuals even though the breach occurred at a processor’s facility.

*This alert is for informational purposes only and does not constitute legal advice. If your organization may be affected by the idscan.net breach or has questions its vendor risk management obligations, please our Privacy, Data Security, and AI Practice Group .

ADDITIONAL INFORMATION

For more information, please :

Roylance L. Bird | 213.430.3410 | [email protected]

Paul J. Malie | 216.696.3466 | [email protected]

Edward W. Racek | 213.430.3405 | [email protected]

This Client Alert has been prepared by Tucker Ellis LLP for the use of our clients. Although prepared by professionals, it should not be used as a substitute for legal counseling in specific situations. Readers should not act upon the information contained herein without professional guidance.