If your driver's license was ever scanned at a rental car counter, a store return desk, or a casino cage, assume your ID is in the IDScan.net leak. Freeze your credit at all three bureaus today, request an IRS Identity Protection PIN, and watch for new-account alerts. Your licence number cannot be changed easily — monitoring is the defence.
What Happened
In early September 2026, security researchers found a dark web marketplace advertising a vast archive of government ID scans. Reporting by Krebs on Security and others traced the collection to IDScan.net, a New Orleans-based identity verification company that processes more than 21 million ID checks a month across some 20,000 locations.
The advertised archive included:
- More than 153 million driver's licence scans
- Roughly 10 million state ID cards
- About 3 million travel documents, including passports
- Around 579,000 medical cards
IDScan.net issued a security notice on September 4, 2026 stating that it had learned on or around September 1 that certain data in its cloud platform may have been accessed without authorisation, and that it would notify potentially affected individuals. The FBI's New Orleans field office opened an investigation, and the first class-action complaints were filed in the U.S. District Court for the Eastern District of Louisiana on September 2.
Why This Breach Is Worse Than a Password Leak
Most breaches expose credentials you can rotate. This one exposes the document that proves who you are.
IDScan.net does not just hold the numbers printed on your licence. Its verification hardware captures the full document — the front image, the machine-readable PDF417 barcode on the back, and in many deployments the infrared layer that banks and licensing authorities use to confirm a licence is genuine. Researchers reviewing the leaked samples noted that scans of this fidelity can satisfy automated identity checks, which is precisely what makes them valuable to fraudsters.
You Cannot Rotate a Driver's Licence
A leaked password is a 60-second fix. A leaked licence scan follows you until the document expires — and the licence number often survives renewal. That is why the response here is about locking down what your ID can be used to open, not about replacing the ID itself.
Are You Affected?
There is no public lookup tool. The practical test is whether a business scanned your ID using IDScan.net's systems. Its own marketing has listed clients including Hertz, Target, FedEx, Motorola Solutions, financial services firm Jack Henry, and Caesars Entertainment — though Caesars has said it has had no active account for IDScan's VeriScan product since February 2025 and never authorised retention of its data.
Records cover people in the United States and Canada. If you have rented a car, processed a high-value return, been age-verified at a casino or dispensary, or been onboarded at a bank branch in the last several years, treat yourself as potentially in scope. Waiting for a letter is not a strategy: notification letters routinely arrive months after the exposure.
Step 1: Freeze Your Credit at All Three Bureaus
This is the single highest-value action and it is free. A freeze blocks new credit accounts from being opened in your name, which is the main thing a valid-looking licence scan enables.
- Equifax: equifax.com/personal/credit-report-services
- Experian: experian.com/freeze
- TransUnion: transunion.com/credit-freeze
Do all three — lenders pull from different bureaus. Keep the PINs somewhere you will find them; you will need them to lift the freeze when you genuinely apply for credit.
Step 2: Get an IRS Identity Protection PIN
Stolen identity documents are used to file fraudulent tax returns and claim refunds. An IRS Identity Protection PIN is a six-digit code that must appear on any return filed under your Social Security number. Request one at irs.gov/ippin. It is free and takes about 15 minutes with ID.me verification.
Step 3: Check Your State DMV Record
Contact your state's DMV or licensing agency and ask whether you can flag your record for suspected identity fraud, and whether any duplicate licence has been issued in your name. Some states will note the file; a few will issue a new licence number on evidence of fraud. Ask specifically about duplicate issuance requests — that is the abuse pattern that matters with leaked scans.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 4: Lock Down Your Financial and Telecom Accounts
- Add a verbal password or account PIN to every bank, brokerage, and mobile carrier account. This defeats the phone-based social engineering that leaked ID details make easy.
- Switch two-factor authentication from SMS to an authenticator app or hardware key, so a SIM swap does not hand over your logins.
- Turn on transaction alerts for every card and account.
Step 5: Watch for ID-Specific Fraud, Not Just Card Fraud
The fraud that follows a document leak looks different from stolen card numbers. Watch for:
- Notices about accounts, loans, or utilities you never opened
- Unemployment or benefits claims filed in your name in a state you do not live in
- Medical bills or explanation-of-benefits statements for care you never received
- A traffic citation or court notice from somewhere you have never been — a classic sign someone presented your licence
- An IRS letter about a return you did not file
Expect Targeted Phishing
Breaches of this profile are followed by convincing scam calls and emails. Criminals who hold your real licence image can quote your address, date of birth, and licence number to sound legitimate. No bank, DMV, or law enforcement agency will ever call and ask you to confirm your full Social Security number or move money to a "safe" account. Hang up and call the number on your own statement.
Step 6: Pull Your Free Credit Reports
Get all three reports at annualcreditreport.com — the only federally authorised source, and free weekly. Read the inquiries section and the addresses section, not just the accounts: an unfamiliar address on your file is often the first visible trace of synthetic identity fraud. Dispute anything you do not recognise in writing.
Step 7: Reduce What Else Is Findable About You
A leaked licence scan becomes far more dangerous when combined with everything else that is publicly purchasable about you. Data brokers and people-search sites sell your current address, phone numbers, relatives, and past addresses — exactly the supporting details a fraudster needs to pass a knowledge-based verification check or convince a call centre agent.
Removing those broker listings does not undo the IDScan.net leak, but it removes the corroborating data that turns a stolen document into a successful account takeover.
How PrivacyOn Helps After a Breach Like This
PrivacyOn continuously removes your personal information from 100+ data broker and people-search sites and keeps submitting removals when those sites relist you. Alongside removals you get dark web monitoring that alerts you when your details surface in leaked datasets, 24/7 exposure monitoring, and family plans covering up to 5 people — useful here, because household members named in broker records are part of the same attack surface. Plans start at $8.33/month, and a free scan shows which brokers are currently publishing your address and phone number.
Frequently Asked Questions
Was my driver's licence in the IDScan.net breach?
There is no public search tool. Assume exposure if a business scanned your licence through IDScan.net's systems — rental car counters, retail return desks, casinos, dispensaries, and some bank branches. Records cover the United States and Canada. Because notification letters can take months, act now rather than waiting for confirmation.
Should I get a new driver's licence number?
Most states will not issue a new number without evidence of actual fraud, and a renewal usually keeps the same number. Ask your DMV whether it will flag your record for suspected identity fraud and whether any duplicate licence has been requested in your name. Freezing your credit protects you more than a new document will.
Is a credit freeze or a fraud alert better?
A freeze is stronger. It blocks new credit from being opened until you lift it, lasts until you remove it, and is free at all three bureaus. A fraud alert only asks lenders to take extra verification steps and expires after one year. For a leak of identity documents, use a freeze.
Will IDScan.net pay for credit monitoring?
IDScan.net's September 4 notice said it would notify potentially affected individuals, and breach notification letters commonly include a monitoring offer. Nothing has been confirmed for every affected person, and the class actions filed on September 2 will take years to resolve. Do not delay a credit freeze while waiting for an offer — the freeze is free today.
Can someone open a bank account with a scanned copy of my licence?
Potentially, yes. That is what makes this breach unusual: the leaked files reportedly include the back-of-card barcode and, in some cases, the infrared layer, which is the fidelity automated identity checks look for. Combine that with your address and date of birth from a people-search site and remote onboarding becomes realistic for a fraudster.
What should I do if I find fraud in my name?
File a report at identitytheft.gov to generate an FTC Identity Theft Report and a personalised recovery plan, file a police report with your local department, and dispute every fraudulent account in writing with both the lender and the credit bureaus. Keep copies of everything — you will need the paper trail for months.