In a notice published September 4 and updated September 29, 2026, IDScan.net says an unauthorized third party accessed part of its cloud environment between April 4 and September 2. The incident involved the VeriScan platform; IDScan says no other product or service has been identified as involved. The company says it learned of the incident around September 1 and is continuing its investigation with outside specialists and authorities.
That confirmed fact needs to be separated from the much larger number that made the incident public. KrebsOnSecurity described a service called Nexus that claimed to offer more than 153 million scans of U.S. and Canadian driver's licenses, along with other identity documents. IDScan has not confirmed that volume as a count of victims or documents copied from its systems.
What IDScan confirmed
The official notice describes unauthorized access to part of the VeriScan cloud environment. Potentially involved data may include full names, contact details, dates of birth, driver's license or passport numbers, and other government-issued identification numbers. IDScan says not all categories necessarily applied to each person and that they depend on what each customer organization collected, processed, or stored.
The investigation is ongoing. The notice does not identify the number of affected people or customers, or the technical path used by the third party. IDScan says it is offering free credit monitoring and identity protection services to potentially affected people.
What the 153 million figure means
The figure of more than 153 million comes from the Nexus service described by KrebsOnSecurity. According to that investigation, Nexus claimed to hold U.S. and Canadian driver's-license scans, more than 10 million identification cards, more than 3 million travel documents or international IDs, and at least 579,000 medical cards. Those figures describe the collection advertised by the service, not an official count published by IDScan.
KrebsOnSecurity said it verified samples, including records that lined up with times when people had presented licenses at rental counters or businesses using identity-verification workflows. The Record, BleepingComputer, and Tom's Hardware later connected IDScan's notice to those reports. The connection is serious and documented, but the nuance matters: IDScan confirms a cloud incident; the 153 million volume remains a claim observed and analyzed by outside sources.
Why identity scans change the risk
A password can be changed; a driver's license, identity photo, or government identifier follows a person for far longer. IDScan's notice lists several categories that may be involved but does not confirm which applied to each person. If Nexus's claims about full scans are accurate, their circulation would create a long-lived fraud risk: account opening, age-verification bypass, false identity checks, and highly personalized phishing.
The risk is not only credit related. A person who receives a call or message containing their name, license number, or an accurate memory of a recent scan may wrongly assume the sender is legitimate. Identity data then becomes a way to make a second step credible: asking for a code, another document, a payment, or account access.
Practical precautions for individuals
If you receive an IDScan notice or a message from a business that scanned your ID, verify it through a channel you open yourself: the official site, the phone number published in the notice, or a known customer-support route. Do not upload a driver's license or passport to a supposed Nexus lookup tool: that would give another party a fresh copy of your document without verifying its identity or intended use.
IDScan is offering free credit monitoring and identity protection. In the United States, its notice also mentions fraud alerts and credit freezes. In Canada and other countries, use local procedures rather than automatically following U.S. steps. Also monitor credit requests, financial accounts, and outreach that uses accurate details to create urgency. If an online account may also be at risk after identity fraud, Soclyde's guide to creating strong, unique passwords explains how to avoid password reuse.
What organizations should ask providers
Organizations that scan driver's licenses, passports, or other identity documents should ask for answers that apply to their own customer accounts: which sites, flows, dates, fields, images, and retention windows are involved. A general provider response is not enough when data is stored by customer or tenant inside a cloud service.
The main control is minimization. If the business need is to check age, presence, or identity at one moment, retaining complete document images must be justified, limited, and audited. Contracts should require deletion evidence, exportable logs, fast notification after abnormal access, and a clear channel for people who do not know which provider processed their document.
The Soclyde connection
Soclyde does not protect IDScan, Nexus, or data already removed from a third-party cloud. The connection is more practical: this incident shows how every provider becomes a concentration point when it stores data or access on an organization's behalf. A small team needs to know which services hold secrets, which integrations use dedicated accounts, and which access can be cut quickly after an alert.
Soclyde helps teams generate unique secrets, keep them in a local-first encrypted vault, and avoid password reuse across vendors, email, and business tools. That does not replace identity-document minimization, but it helps limit the risk of an account being taken over with a reused password. To act, read the secure password generator guide, use the password generator, or contact Soclyde.
Key points
IDScan's notice, updated September 29, 2026, says a third party accessed part of the VeriScan cloud environment between April 4 and September 2. Contact details, dates of birth, and ID numbers may be involved, but the notice gives no total number of affected people.
The 153 million driver's-license figure remains a Nexus claim documented by outside sources, not an official IDScan count. For individuals and organizations, priorities are to verify notices through safe channels, limit identity-document collection, and require minimal retention. For a review of account practices, see the SMB password policy guide.
