VeriScan Breach Advisory

Advisory

DRG-SA-2026-001

Subject

IDScan.net / VeriScan — alleged large-scale exposure of scanned identity documents

Issued

September 2, 2026

Status

Active — vendor has confirmed the incident; reviewed September 12, 2026 (rev 6)

Next review

Week of September 21, 2026

Audience

Individuals whose IDs have been scanned at commercial venues; organizations that scan customer or staff IDs

Executive summary

• A dark-web marketplace listed for sale a large trove of scanned identity documents — driver's licenses, ID cards, passports, and medical cards — which the seller attributes to IDScan.net, the company behind the widely deployed VeriScan ID-scanning platform (bars, venues, festivals, dispensaries, casinos, rental counters, retail).
• The seller's claimed total of 153 million+ records is unaudited; however, sampled records have been independently confirmed as authentic by two named individuals, including the journalist who broke the story.
• IDScan.net has confirmed the incident. Its Notice of Data Security Incident, dated September 4, 2026, states that an unauthorized third party "may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud," including full names and driver's license or other government-issued identification numbers. The company offers free credit monitoring and a hotline (1-833-516-2980) and says it is cooperating with federal law enforcement. The notice gives no count of affected individuals. The FBI has reportedly opened an inquiry.
• No mechanism exists for individuals or businesses to confirm whether their records are included; the vendor notice does not identify who is affected. The prudent posture is to assume inclusion and act on the recommendations in sections 4–6.
• The recommended individual protections are free of charge and take approximately 45 minutes in total.

Review update — September 12, 2026

• Nothing in the September 10 review has changed. The vendor notice, the hotline, the nine filed cases, the absence of a victim count, the absence of individual letters, and the absence of any CISA or state attorney-general action were all re-checked on September 12 and stand. CONFIRMED
• The notice is not findable by searching. IDScan.net's notice page carries a search-engine directive (noindex) and is not linked from the company's homepage — both checked directly on September 12. The notice is genuine; it is simply not discoverable. Use the direct link in section 2, and share it rather than telling people to "look it up." CONFIRMED
• The vendor's framing of the exposure. The notice states: "Though full access to the information required payment, in an abundance of caution, we are notifying potentially impacted individuals of this incident." That is IDScan.net's characterization. This advisory's assessment is unchanged: the marketplace sold records before it went offline (section 1), so a paywall on the listing is not evidence that the data went unsold. CONFIRMED (the quote) · REPORTED (prior sales, per the original reporting)
• The recommendations in sections 4–6 are unchanged.

Review update — September 10, 2026

• The vendor has confirmed the incident. IDScan.net published a Notice of Data Security Incident dated September 4, 2026, read directly on September 10. It states that on or around September 1 the company "received information indicating that certain data may have been accessed without authorization," that an unauthorized third party "may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud," and that the affected data "may include full names and driver's license or other government-issued identification numbers." CONFIRMED This supersedes the issue-date and September 4 statements that no vendor notice existed.
• A notification channel now exists. The notice offers free credit monitoring and identity-protection services to potentially affected individuals, a hotline at 1-833-516-2980 (Monday–Friday, 8am–8pm ET), and a mailing address, and states the company is "cooperating with federal law enforcement on their investigation." CONFIRMED The notice does not state how many people are affected and does not identify accounts in scope; no individual notification letters have been reported.
• Litigation has grown. A docket-level review dated September 8 counts nine class-action cases against IDScan.net in the U.S. District Court for the Eastern District of Louisiana (case numbers 2:26-cv-01929 through 2:26-cv-01956, filed September 2–4), up from the four reported on September 4. REPORTED The count is a moving figure; individual filings have not been independently reviewed.
• Customer-list correction. Caesars Entertainment, named among reported customers in the original reporting, has told Krebs on Security it has not been an IDScan.net client since February 2025, despite appearing on IDScan.net's marketing site. REPORTED Section 3 is amended accordingly.
• Victim count remains unconfirmed. Press now cites figures of 150–170 million documents; none originate from IDScan.net, whose notice gives no number. The 153-million figure in this advisory remains the seller's. SELLER-CLAIMED
• No state breach-registry entry or CISA advisory identified. The California Attorney General's breach list and CISA's advisories carried no IDScan.net entry on September 10; the Texas Attorney General's breach-report page could not be retrieved for this review and remains scheduled for an interactive check. UNKNOWN
• The recommendations in sections 4–6 are unchanged; the vendor's confirmation strengthens, and nothing in this review weakens, any of them.

Every claim in this advisory carries one of four evidence-strength labels:

1Incident overview

• A marketplace known as Nexus, advertised on a Russian-language criminal forum, listed the dataset for sale. Journalist Brian Krebs was alerted on August 31 and published the first report. CONFIRMED
• Claimed inventory: 153 million driver's-license scans (US and Canada), 10 million ID cards, 3 million passports and travel documents, and 579,000 medical cards. No independent audit of these totals exists. SELLER-CLAIMED
• Sampled records are authentic: Krebs located his own license in the dataset, and security researcher Zach Edwards located his — with a visit timestamp matching a verifiable trip to a venue using IDScan technology. CONFIRMED
• Records reportedly include front and back scans with infrared and ultraviolet captures — authentication-grade imagery that materially aids document forgery — plus timestamps associating each scan with a specific business visit. REPORTED, corroborated at the sample level.
• The seller claims exfiltration ran for over a year and was ongoing at the time of listing. SELLER-CLAIMED
• The FBI's New Orleans field office has opened an inquiry, confirmed to Krebs directly; no public FBI statement exists. REPORTED
• The Nexus storefront went offline after publication. Records sold prior to the takedown remain in circulation and cannot be recalled. REPORTED
• The intrusion vector has not been established. A theory involving IDScan.net's API layer is circulating; it is analyst speculation, not a forensic finding. UNKNOWN

2Vendor response to date

Official notice (September 4, 2026). IDScan.net's Notice of Data Security Incident confirms that an unauthorized third party may have accessed and copied customer information — full names and driver's license or other government-issued identification numbers — stored in customer accounts on the IDScan.net cloud; that the company secured its systems and engaged third-party specialists; that the investigation is ongoing; and that it is cooperating with federal law enforcement. It offers free credit monitoring and identity protection and a hotline at 1-833-516-2980. CONFIRMED Earlier, in a statement to press on the issue date, the company had said it received information on September 1 suggesting exposure and had "not reached conclusions" as to whether unauthorized access occurred; the September 4 notice resolves that question. REPORTED

The notice also states: "Though full access to the information required payment, in an abundance of caution, we are notifying potentially impacted individuals of this incident and providing access to free credit monitoring and identity protection services." CONFIRMED Readers should weigh that sentence against section 1: the marketplace listing was for sale, and records sold before the takedown remain in circulation.

3Exposure assessment

No lookup tool exists, and any site offering one should be treated as fraudulent. Reported enterprise customers include Hertz, Target, FedEx, and more than 1,000 dispensaries — a list that traces entirely to the original reporting; no named company has confirmed it. Caesars Entertainment, also named in that reporting, has stated it has not been an IDScan.net client since February 2025. REPORTED IDScan.net's own documentation shows that its entry-level cloud plan was fixed to permanent retention ("Do not delete"), with no customer-side override. CONFIRMED

Exposure is not limited to customers. Organizations also use these platforms for employee onboarding, credentialing, and visitor management — contexts in which passports and carry licenses are commonly scanned alongside driver licenses. Staff whose documents were captured this way should follow section 4 in the same manner as scanned customers.

The realistic assessment: an individual whose ID was scanned at a VeriScan-equipped business in recent years should assume inclusion. Individuals are advised to retain receipts or records of where their ID was scanned; class-action litigation is under way (see the September 10 review update), and such records help establish standing.

4Recommended actions — individuals

Priority actions. All are free of charge; total time is under an hour.

1. Place a security freeze with all three credit bureaus — Equifax, Experian, TransUnion. Freezes are free, unlimited, and processed within one business day online. This is the single highest-value protection available.
2. Extend the freeze to ChexSystems (chexsystems.com), which governs bank-account screening the major bureaus do not cover. For complete coverage, add Innovis and NCTUE (1-866-349-5355), which cover telecom and utility account openings.
3. Obtain an IRS Identity Protection PIN at irs.gov/ippin. Enrollment is open to anyone and blocks tax returns filed under your Social Security number without the PIN.
4. Enable your carrier's port-freeze and account PIN. Federal rules require every US wireless carrier to offer these at no charge (AT&T "Extra Security," Verizon "Number Lock," T-Mobile "Port-Out Protection"). The lock and the PIN are separate settings; both defend against SIM-swap attacks.
5. Register for USPS Informed Delivery at usps.com. Registering your own address prevents a documented fraud pattern in which criminals register it to intercept newly issued cards and account mail.
6. Harden account recovery, not just passwords. Enable app-based two-factor authentication or passkeys (not SMS codes) on email and financial accounts, and ask your bank and carrier to place a verbal password on the account. The exposed data — ID image, date of birth, address — is precisely what identity-verification and password-reset flows ask for; strong second factors close that path. Note that no passwords were exposed in this incident, so wholesale password changes are not required — though weak or reused passwords are always worth replacing.

5Document-specific guidance (Texas)

Passport

If the physical passport is in your possession, do not file Form DS-64 — it applies only to lost or stolen books and cancels the passport. No fee-free replacement exists for a data-only exposure. Early renewal (Form DS-82; standard fees and eligibility rules apply) issues a new passport number and is available as an optional measure. A scanned image alone cannot be used for border crossing; its criminal utility is account and verification fraud, which the freezes in section 4 substantially mitigate.

Driver license

Issuance of a new license number is discretionary: the Texas Department of Public Safety considers it only upon a police report showing the license was stolen and misused, decided case by case. No guaranteed proactive path exists prior to actual fraud. If fraud occurs: file at IdentityTheft.gov, obtain a police report, and present both to DPS.

License to Carry

The LTC has the clearest remedy of the three documents: DPS automatically assigns a new LTC number when replacing a lost or stolen card (Form LTC-70, or the RSD online portal). Holders should also weigh a physical-security consideration: the exposed records pair a home address with confirmed handgun-licensee status. Reviewing home and firearm-storage security is an appropriate part of the response.

6Recommended actions — organizations that scan IDs

The following is provided for planning purposes and is not legal advice.

1. Determine whether VeriScan or IDScan.net appears anywhere in your operation — owned equipment, venue door staff, a vendor's age-verification application, or employee onboarding, credentialing, and visitor-management workflows. IDScan.net reports more than 4,000 age-restricted venues among its customers, including festivals.
2. If present, submit a written inquiry to IDScan.net: which plan the account is on, what retention was configured, whether images were retained, which record types the account holds (customer scans as well as employee or visitor records), and whether the account is suspected to be in scope.
3. Review the contract and data-processing agreement. Consumer-notification duties generally rest with the business rather than the vendor; IDScan.net's privacy policy reportedly directs individuals to the business that scanned them. Texas law requires notifying affected individuals "as quickly as possible" and reporting to the Attorney General within 30 days when 250 or more Texas residents are affected — and notification clocks may run from discovery, not from vendor confirmation. Timely legal review is warranted.
4. Configure for minimum retention going forward, regardless of vendor: do not store ID images unless compliance genuinely requires them; a barcode-only pass/fail age check requires no image; set automatic purge to the shortest interval the plan permits.

7Open questions

• Which IDScan.net system was compromised. UNKNOWN
• Whether any specific venue or customer account is in scope; no self-service verification exists. UNKNOWN
• The true size of the dataset; the 153-million figure is the seller's. SELLER-CLAIMED
• How many individuals and which customer accounts are affected; the vendor notice states neither. UNKNOWN
• Regulatory response: no CISA advisory, state attorney-general action, or Canadian regulator statement identified through the September 12 review.
• Scheduled for the next review: individual notification letters, the contents of the nine lawsuit filings, and an interactive check of state breach registries (Texas AG portal).

8References

Krebs on Security (original report; FBI and vendor statements) · Cybernews · Malwarebytes · CyberInsider · Hall Attorneys investigation · IDScan.net, Notice of Data Security Incident (September 4, 2026; read directly September 10) · PCMag (class-action filings, Sept 2026) · Zyphe docket review (E.D. La. case list, Sept 8, 2026) · IDScan.net product and retention documentation, and trust center (reviewed directly) · USA.gov · Equifax · Experian · TransUnion · ChexSystems · NCTUE · IRS · FTC · Texas DPS · Office of the Texas Attorney General · FCC (SIM-swap and port-out protection rules).