153 Million Driver's Licenses Leaked: What to Do Now

If you have handed your driver's license to a business that scanned it, a bar, a dispensary, a car dealership, a rental counter, you may be affected by what appears to be the largest exposure of government identity documents ever recorded in North America. In early September 2026, a dark web service called Nexus advertised paid access to digital scans of identity documents belonging to more than 170 million people. The FBI confirmed it is investigating. There is no consumer lookup tool, no notification letter, and nothing you can do to un-leak a document scan. What you can do is make the scan far less useful to whoever holds it, and that starts today.

What exactly happened?

On August 31, 2026, a source alerted the security journalist Brian Krebs to a new listing on a Russian cybercrime forum offering a service called Nexus. Krebs published on September 1. The service claimed to hold more than 153 million driver's licenses from the United States and Canada, over 10 million identification cards, more than three million travel and international identity documents, and around 579,000 medical cards.

This was not an unverified claim. Krebs found his own Virginia license offered as a free sample, and confirmed the authenticity of the documents with nine individuals whose licenses were being sold. A Minnesota license belonging to Defense Secretary Pete Hegseth was displayed as an example. The FBI told multiple outlets on September 3 that it was looking into the incident. The Nexus site has since gone offline.

Where did the scans come from?

Attention has focused on IDScan.net, an identity verification company based in New Orleans whose technology is used by businesses to scan and check customer IDs. Krebs reported a common thread among people whose documents appeared: their licenses had recently been scanned by businesses using such services.

The company issued a statement saying that on or around September 1, 2026 it received information indicating certain data may have been accessed without authorization, and that an unauthorized third party may have accessed or copied customer information stored within accounts on its cloud. It said it took immediate steps to secure its systems, engaged third-party specialists to determine the scope, and is cooperating with federal law enforcement. The investigation is ongoing and the full picture may change.

Was I affected?

There is currently no way to check, and that is the frustrating reality. No lookup tool exists, notification letters have not gone out, and the scale of the dataset means it is not practical to search yourself in it.

The sensible posture is to assume exposure if you have shown your license to a business that scanned it electronically rather than glancing at it. That covers a very large share of adults in the US and Canada, which is exactly why the numbers are what they are. Treat the absence of a notification as meaning nothing either way.

Why is a license scan worse than a leaked password?

Because of what you can and cannot change. A password takes a minute to reset. A driver's license scan is a high-fidelity image of a government credential containing your full legal name, date of birth, home address at time of issue, license number, signature, and photograph. You cannot reset your face or your date of birth, and obtaining a new license number is difficult and not something states grant on request.

The particular danger is identity verification. A growing number of services, financial accounts, crypto exchanges, marketplaces, and government portals, ask you to upload a photo of your ID to prove who you are. A stolen scan is precisely the artifact those systems are designed to accept. One threat researcher quoted in coverage of the incident said there has never been a breach of driver's licenses at this scale, and the president of the Identity Theft Resource Center noted that a dataset like this retains value to criminals for many years. This is not a problem that expires.

What should I do today?

1. Freeze your credit at all three bureaus. It is free, takes a few minutes each, and blocks new accounts from being opened in your name even by someone holding your documents. This is the single highest-value step, covered in our credit freeze guide.
2. Get an IRS Identity Protection PIN, which stops anyone filing a tax return in your name without it. Name, date of birth, and address are the core inputs for tax refund fraud.
3. Move off text-based two-factor authentication onto an authenticator app or passkey, since a convincing identity document makes carrier social engineering considerably easier.
4. Check your state's process for a new license number if you experience actual fraud. Requirements vary and evidence of misuse is usually needed, so this is a response to harm rather than a precaution.
5. Expect targeted scams. Anyone holding your document can quote real details to sound legitimate. Treat unsolicited contact referencing your license, your address, or your date of birth as suspect regardless of how accurate it is.

Can the leak itself be removed?

No. Once a document scan is circulating, it is copied and resold indefinitely, and no service, ours included, can retrieve it. Anyone offering to delete your leaked documents from the dark web is selling something that does not exist, a point we make in full in is your information on the dark web.

The realistic goal is to break the second half of the attack. A document alone often is not enough to impersonate you, because verification processes and fraudulent applications typically require supporting details: your current address, your previous addresses, your date of birth, the names of people in your household. A leaked license from three years ago carries an old address. What makes it current and usable is a people-search profile that supplies the rest, freely, to anyone. Removing those listings does not undo the leak. It raises the effort required to turn a stolen image into a working impersonation, and those listings rebuild continuously from public records, so it takes maintaining. Consumer Reports found that opt-outs done by hand or by automation cleared roughly 27 percent of exposed listings, while removals handled by real people who monitor and refile reached about 70 percent.

Frequently asked questions

Should I get a new driver's license number?

Not as a precaution. States generally require evidence that your identity is actually being misused, and the process varies. If you experience fraud, contact your motor vehicle agency and ask what is available. For most people a credit freeze delivers far more protection with far less effort.

Does a credit freeze stop someone using my license scan?

It stops the most common and most damaging use, opening new credit accounts in your name. It does not stop tax fraud, benefits fraud, or someone passing an identity check at a service that only asks for a document image, which is why the IRS PIN and general vigilance matter alongside it.

Can I find out if my license was in the dataset?

Not at present. There is no consumer lookup tool and the service that advertised the documents is offline. Be cautious of any website appearing now and offering to check whether your license was leaked, since breach panic reliably attracts its own scams.

Should I stop letting businesses scan my ID?

Often you cannot refuse and still get the service. Where you have a choice, you can ask whether a visual check will do instead of a scan, and ask how long the image is retained. It is a reasonable question, and incidents like this are the reason to ask it.