Millions of Americans could be wondering whether their personal information is at risk after a massive cache of driver’s license records allegedly surfaced on the dark web, triggering an FBI investigation and raising concerns about identity theft.
The investigation centers on a dark web marketplace known as “Nexus,” which claimed to offer access to more than 153 million driver’s license records from the United States and Canada, as well as millions of other identity documents.
Federal authorities haven’t yet confirmed the size of the exposure, but the allegations have already prompted legal action and heightened scrutiny of the identity verification industry.
What Happened?
The incident first came to public attention on September 1, after KrebsOnSecurity, an independent cybersecurity news outlet, reported the existence of Nexus, a platform advertising access to driver’s license scans and other forms of identification. The service claimed to possess more than 153 million driver’s license records, over 10 million ID cards, and millions of additional documents, including medical cards and travel documents.
According to KrebsOnSecurity reporting, evidence suggested that the records being sold on Nexus may have been sourced from data collected by IDScan.net, a New Orleans-based identity verification company.
On September 4, IDScan.net publicly disclosed a data security incident, which was published by PR Newswire, stating: “On or around September 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization.”
The company said an unauthorized third party may have accessed or copied customer information stored in cloud accounts. Potentially affected information includes names and driver’s license or other government-issued identification numbers.
IDScan.net said its investigation remains ongoing and that it is working with third-party specialists to determine the full scope of the incident.
FBI Investigation Underway
The New Orleans FBI has confirmed it’s investigating the incident but has released few details.
“The FBI can confirm that it is looking into the incident,” the bureau told FreightWaves, adding that it could not comment further due to the ongoing nature of the investigation.
Several proposed class-action lawsuits have also been filed against IDScan.net, alleging failures to adequately protect sensitive personal information.
At the time of publishing, the company hasn’t admitted any wrongdoing.
What Should You Do if Your Information Was Exposed?
While it’s not yet clear how many people were affected, experts generally recommend taking proactive steps whenever sensitive identification information may have been compromised.
Monitor Your Credit
Regularly review your credit reports and financial statements for unfamiliar accounts, inquiries, or transactions. Identity thieves can use personal information to open new accounts or apply for credit in someone else’s name.
Consider a Fraud Alert or Credit Freeze
Consumers can place a fraud alert on their credit file or freeze their credit with the major credit bureaus. A credit freeze can make it much harder for criminals to open accounts using stolen information.
Consumers concerned about potential exposure can take a proactive step by placing a free credit freeze with each of the three major credit bureaus, which can make it harder for identity thieves to open new credit accounts in their name. Because a freeze must be placed separately with each bureau, consumers can call:
- Equifax at (888) 298-0045
- Experian at (888) 397-3742
- TransUnion at (800) 916-8800.
Watch for Signs of Identity Theft
Warning signs can include:
- Unexpected bills or collection notices
- Credit applications you did not submit
- New accounts appearing on your credit report
- Communications from lenders or financial institutions you do not recognize
Will Affected People Be Notified?
According to IDScan.net, the company is reviewing potentially affected records and plans to notify impacted individuals. It also said it will offer free credit monitoring and identity protection services to those whose information is determined to have been involved.
“Potentially impacted individuals are encouraged to enroll in the free credit monitoring and identity protection services IDScan.net is making available and to monitor their account statements for suspicious activity and to detect errors,” the company said in its public notice.
For now, investigators are still working to establish exactly what data was accessed and how many people may have been affected. Until more information emerges, cybersecurity experts say consumers should remain alert for signs of identity theft and take advantage of monitoring services if they are notified that their information was exposed.
Newsweek has emailed the New Orleans FBI and IDScan.net for comment and is awaiting responses.
Contact Newsweek editors on this story: Ben Kelly and James Debens