You cannot rotate a driver's licence

A driver’s licence record on the service was six image files. Front and back photographs, a plain scan, and then the infrared and ultraviolet versions, each carrying a timestamp [1].

Those last two are the interesting ones. They are not pictures of you. They are pictures of the security features your province or state embeds so a clerk can tell a real licence from a printed one.

The system that captured them exists to detect fakes. It kept the images.

What happened

On September 1, 2026, Brian Krebs reported an identity theft service called Nexus, launched on a Russian-language cybercrime forum, offering digital scans of identity documents belonging to millions of North Americans. The listings covered more than 153 million US and Canadian driver’s licences, over 10 million identification cards, more than 3 million travel documents and international IDs, and roughly 579,000 medical cards [1]. About 1.1 million of the licences were Canadian [3].

Krebs did not take the seller’s word for the volume. He paged through the index without search parameters, found roughly 11.5 million pages at about 15 results each, and reported that the arithmetic supported the claim [1]. That is a small thing and it is the difference between reporting a number and checking one.

The attribution came from timestamps. Researcher Zach Edwards found his own licence in the corpus with a timestamp matching a visit to a cannabis dispensary that publicly uses IDScan.net for ID checks. Krebs found his own record, and its images included the infrared and ultraviolet captures that match IDScan.net’s documented technology. Rental counter visits by several other people lined up the same way [1][2].

IDScan.net’s COO told Krebs the company was investigating [1]. Its CEO did not respond to TechCrunch [2]. The FBI’s New Orleans field office, in the state where IDScan.net is based, opened an investigation on September 1 [1][2]. SecurityWeek reported that some of the exfiltrated licences appear to belong to FBI agents [3], which is one explanation for the speed.

Nexus went offline after the reporting published [2].

Why this matters

The leaked layer is the one that establishes authenticity. IDScan.net’s own documentation describes scanning under white, ultraviolet and infrared light, comparing what appears under UV against the template for that jurisdiction’s format, checking holograms and verifying microprints at pixel level, across more than 400 automated checks [4]. That is a detailed capture of how a genuine document is constructed. Reporting on the leak notes that access to this source material could make fraudulent submissions harder to distinguish from real ones [1].

There is no remediation available to the individual. A password can be rotated and a card number reissued. The security design of Ontario’s licence, or Louisiana’s, is a fixed physical artefact shared by every holder, and nobody is reprinting it because a vendor lost the scans. For the people in this set, the usual advice runs out quickly.

The businesses in the middle are small. Dispensaries, rental desks and retail counters bought a compliance tool to check ages and catch fakes [4]. Almost none of them chose a data retention posture, because that was not the thing they were buying. They now sit inside somebody else’s breach.

Technical breakdown

The intrusion is the part nobody has explained, and that is worth stating plainly before anything else. Neither the company, the FBI, nor any researcher has published how the data was obtained, when the compromise began, or whether access continues [2]. What is documented is the shape of the collection either side of that gap.

On the capture side, authentication requires specialty hardware that images the document under three wavelengths simultaneously, with the results checked against jurisdictional templates by a model IDScan.net says was trained on over 500 million scanned documents [4]. The output is not a yes or no. It is a set of images, and in this corpus those images persisted with per-scan timestamps accurate enough for two researchers to reconstruct where and when they had personally handed over a licence [1].

On the extraction side, timestamps across the corpus spanned roughly a year, which points to sustained access rather than one grab [1]. While the service was live Krebs observed the record count grow by about 400,000 in twenty four hours [1]. The operators separately claimed around 500,000 new documents a day from a major identity verification company [2]. Those two numbers are close and they are not the same number, and only the first one was observed rather than advertised.

The three breaks sit before the incident rather than during it, which is the uncomfortable part. Not capturing the image, not keeping it, and noticing when it leaves are the whole defence. Once the corpus exists and is indexed, every remaining step belongs to somebody else.

The standard does not tell anyone to delete it

I expected NIST SP 800-63A to require disposal of identity evidence after proofing, because that is what people cite when they say a verification vendor is compliant. It does not.

Revision 4 requires a credential service provider to have a documented and publicly available deletion process and default retention period for biometric information, and separately requires the practice statement to document retention, protection and deletion of personal, sensitive and biometric data [5]. It sets no timeframe for images of identity documents and prescribes no method. The requirement is to have a policy and publish it, not to minimise.

That is not a flaw hidden in the text. It is the text. And it means “we follow NIST guidance” is compatible with keeping your licence scan indefinitely.

What defenders should do Monday morning

Immediate, within 24 hours. If you operate ID scanning at a counter, find out what your deployment retains and where it goes. The specific question is whether the infrared and ultraviolet captures persist after the check completes, because that is the material at issue here. If you are a consumer in the affected set, place a credit freeze, which is free and reversible, and stop treating identity verification prompts as routine.

Near term, this week. Send your vendor the three questions in writing: what is retained, what the documented deletion process and default retention period are, and whether the deployment can be configured to return a result without storing imagery [5]. Then check your own contract for a retention clause, and note whether you ever asked for one. Review who inside your business can export records in bulk from the platform, and whether anyone would see it happen.

Structural, this quarter. Treat identity evidence the way you already treat payment card data: something you handle, verify and do not keep. Then go through the rest of your vendor estate for the same pattern, which is any supplier that retains a high-value artefact as a by-product of performing a check. Verification exhaust is a category, and this will not be the last time it leaks.

Checklist

• Every ID scanning deployment inventoried, including which businesses and which hardware
• Retention behaviour confirmed for document imagery, including infrared and ultraviolet captures
• Vendor asked in writing for its documented deletion process and default retention period
• Contract checked for a retention clause, and one added where absent
• Deployment reconfigured to return a result without persisting imagery where the use case allows
• Bulk export from the verification platform restricted and monitored
• Alerting in place for sustained high-volume reads, not only for authentication failures
• Consumers advised on credit freezes where you know their documents were scanned
• Vendor estate reviewed for other suppliers retaining artefacts as a by-product of a check

Verification should be built to forget

The failure here is not that a company was breached. Companies are breached constantly and this post would be unremarkable if the losses were names and addresses.

The failure is that an industry built to confirm documents are real decided, by default and without much argument, to keep the evidence it generated while confirming them. Six files per person. Infrared and ultraviolet included. Timestamped precisely enough to place someone at a dispensary on a particular afternoon. None of that was necessary to answer the question the customer at the counter was actually asking, which was whether this person is over nineteen.

The check is the product. The image is exhaust, and exhaust that identifies 153 million people should be treated as a liability from the moment it is created rather than as an asset because storage is cheap. The standards could say so and currently do not, which leaves the decision with the businesses buying these platforms. So make it deliberately. Ask what your vendor keeps, write the answer into the contract, and be prepared to hear that nobody has thought about it, because that is the answer this incident suggests is common.