IDScan, 150 million driver's licences: the identity verification supplier as an aggregation point

On 10 September 2026 IDScan, an identity document verification supplier to venues, casinos and dispensaries, confirmed data theft from its cloud systems, while a dark web site was selling more than 153 million driver's licences. The analysis: the invisible supplier, documents that cannot be changed, liability towards customers and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, September 2026 · by cybercoverinsurance

On 10 September 2026 IDScan.net, a Louisiana company that verifies identity documents for venues, casinos and cannabis dispensaries, confirmed that data had been stolen from its cloud systems. A few days earlier a dark web site called Nexus had put more than 153 million US and Canadian driver's licences up for sale, with document images, which the seller attributed to IDScan. Between 2 and 4 September nine class actions had already been filed against the company.

For cyber underwriters the case shows a little-known supplier concentrating data on millions of people on behalf of many customers. The damage does not stay with the supplier: every customer that scanned a document may face notification obligations and lawsuits.

What is known

The company. IDScan provides identity document verification to business customers, from entertainment venues to cannabis dispensaries. Its website states more than 150 million driver's licence records (TechCrunch).

The discovery. Around 1 September IDScan received information about a hacking claim, on the same day journalist Brian Krebs published the story after finding his own record on the sale site. On 10 September the company confirmed in a notice that data had been taken from its cloud accounts, including names, licence numbers and numbers of other documents such as passports. The FBI opened an investigation and the Pentagon said it was aware of the breach (TechCrunch).

The data for sale. According to reports cited by Malwarebytes, Nexus offered more than 153 million driver's licences, 10 million ID cards, 3 million travel documents and 579,000 medical cards, including cannabis dispensary cards. Some records included front and back document images and infrared and ultraviolet scans (Malwarebytes). The seller said it had been taking data for more than a year.

What is not known. IDScan has not disclosed the number of people affected, how access was gained or how long it lasted. It has not confirmed that all the Nexus data came from its systems. In its notice it wrote that "full access to the information required payment", without saying whether this referred to a ransom demand (TechCrunch).

The invisible supplier

One intermediary, many customers. Someone entering a venue or renting a car does not choose IDScan and often does not know their document passes through it. For a portfolio, the verification supplier is a hidden aggregation point inside the customer check-in process.

The customer that left. A Caesars Entertainment spokesperson said the company had stopped using IDScan in February 2025, while IDScan still listed it as a customer (Zyphe). Customer data can remain in a supplier's systems after the contract ends.

Retention. Checking a document takes a few seconds, but the data was kept, judging by the records on sale, with full images. Each record kept longer than needed increases the number of people to notify.

Identity documents, lasting damage

Data that cannot be changed. A password can be changed; a driver's licence or passport cannot, or only with cost and delay. Front and back images with security scans can be used to create fake documents and pass other identity checks. The harm to individuals lasts for years.

Notification costs at scale. With more than 150 million records claimed, even a minimal cost per person produces very high totals for notification, credit monitoring and support services. US state breach laws treat driver's licence numbers as personal data that triggers notification.

Class actions within days. Nine class actions filed in three days in the federal court for the Eastern District of Louisiana (Zyphe). Liability arrives before the breach is even confirmed: for the supplier's policy, defence costs start at once.

Liability towards customers

The supplier's customers. Venues, casinos and dispensaries collected their own customers' documents. Depending on the applicable law, notification obligations may fall on them as data owners, even though the breach happened at IDScan. For the insured, cover for a data breach at a third party becomes decisive.

Recovery from the supplier. IDScan's customers may try to recover notification costs from the supplier. If claims from many customers and millions of people arrive together, the supplier's policy limits run out fast and recovery for the customer's insurer becomes uncertain.

Health data. The 579,000 medical cards, including medical cannabis cards, are health data (Malwarebytes). Where health data rules apply, obligations and penalties are heavier.

What to bring to renewals

Impact for insurersHigh

Identity document data on more than 150 million people, according to the seller, was stolen from IDScan, an identity verification supplier to many businesses, with nine class actions within days.

On the portfolio side, the IDScan case suggests identifying insureds that use identity verification suppliers, especially in entertainment, casinos and rentals, and treating these suppliers as aggregation points: one incident produces notifications and lawsuits for many insureds at once.