KrebsOnSecurity (1 September 2026) reported a dark-web identity-theft service branded Nexus advertising digital scans of more than 153 million US and Canadian driver’s licences plus millions of other ID cards, travel documents and medical cards. Krebs’s checks pointed to Louisiana identity-verification firm IDScan.net as the likely source; the company said it was investigating and the FBI New Orleans field office opened an inquiry.

SecurityWeek (3 Sep) and Ars Technica (2 Sep) corroborated the listing. BleepingComputer (4 September 2026) reports multiple lawsuits against IDScan, with firms including Markovits, Stock & DeMarco and Hall Attorneys launching investigations into potential class-action litigation.

Nexus appeared to shut shortly after Krebs published. Organisations that rely on third-party ID-scan vendors should treat this as a supply-chain identity risk.

NEW 10 September 2026 (BleepingComputer): IDScan published a 4 September 2026 security notice (initially noindex) stating it learned on or around 1 September that an unauthorised party may have accessed or copied customer information in IDScan.net cloud accounts — full names and driver's licence or other government ID numbers — and that investigation continues with third-party specialists.

IDScan's notice does not mention the Nexus listing or the 153 million figure; the link between the two comes from KrebsOnSecurity's reporting.

UPDATE (IDScan notice, updated 29 September 2026): IDScan says an unauthorised third party gained access to a portion of its cloud environment between 4 April and 2 September 2026, that the event was limited to its VeriScan platform, and that the information potentially involved could include full name, contact information, date of birth, and driver's licence, passport or other government ID numbers, varying by how each customer organisation used VeriScan; it says it is not aware of misuse.

UPDATE 16 September 2026 desk: primary_url switched to IDScan.net press notice (datePublished 4 Sep 2026) stating unauthorised access/copy of cloud customer info may include full names and driver's licence or other government ID numbers; free credit monitoring offered; cooperating with federal law enforcement. ACS Information Age (8 Sep) re-covered the dump for AU readers — no new scope beyond vendor notice.

Correction (22 Oct 2026): an earlier version said IDScan's notice tied the company to the 153M+ licence dump; the notice does not mention the dump, and that link is KrebsOnSecurity's reporting. (source: https://idscan.net/press-release/notification-of-data-security-incident/)