FBI reportedly opens inquiry into suspected IDScan.net data breach

The investigation follows the appearance of a service calling itself Nexus, which surfaced this week on a Russian-language cybercrime forum and began offering access to digital images of North American identity documents. Among the records offered for sale was a driver's license scan purportedly belonging to U.S. Defense Secretary Pete Hegseth.

In its sales posting, Nexus claimed to hold scans of more than 153 million driver's licenses issued in the United States and Canada, along with over 10 million identification cards, more than three million travel and international identity documents, and roughly 579,000 medical cards. The operators said the material came from an active intrusion at a major identity verification provider whose clients include Fortune 500 companies, and stated that they had been extracting records into a private database for more than a year. The claims have not been independently confirmed.

The FBI has not released a public statement detailing the scope of the investigation. Idscan.net has not published a response addressing the allegations.

Idscan.net operates identity verification systems used by retailers, rental companies, financial institutions and licensed businesses that are legally required to check customer ages or identities. According to material published by the company, its technology carries out more than 21 million verifications each month across upward of 20,000 locations worldwide. The firm's own documentation describes hardware that reads identity documents using infrared and ultraviolet light in addition to standard imaging.

A trust page maintained by idscan.net lists Hertz, Target, FedEx, Motorola Solutions, financial services provider Jack Henry and Caesars Entertainment among the brands it works with.

The company said in a 2022 press release that it had signed an exclusive identity verification agreement covering the national operations of Planet13, a cannabis dispensary chain with outlets in California, Florida, Illinois and Nevada. Idscan.net states that it handles age and identity checks for more than 1,000 dispensaries across 19 U.S. states.

Driver's licenses have taken on a broader role in U.S. commerce and security in recent years. Since May 2025, the Transportation Security Administration has required a Real ID compliant license, or an alternative document such as a passport, for domestic air travel. Licenses are also routinely used to verify identity when opening bank accounts or applying for credit, which makes high-resolution scans of them valuable to fraud operations.

Security specialists have long warned that the growth of online and in-person age verification requirements concentrates sensitive identity records in third-party vendors, expanding the number of systems that hold copies of the same documents.

The Nexus site later went offline. Its login page was replaced with a short message stating that the service was no longer available.

Earlier, Qazinform reported that American private aerospace company Blue Origin had been awarded a contract by NASA on Tuesday to develop the agency's Mars Telecommunications Network, a next-generation communications system designed to provide reliable, high-bandwidth communications and navigation services for current and future Mars missions.