AINEWS
A New Orleans identity verification vendor whose scanners sit in 20,000 retail locations appears to be the source of a year long leak the FBI is now investigating.
When you hand a driver's license to a hotel front desk, a rental car counter, or a sportsbook age check, the scanner that reads it is rarely owned by the brand you are visiting. A third-party identity-verification vendor runs the device, and the vendor keeps a high-resolution copy of your ID on file: front, back, and in some cases infrared and ultraviolet captures layered on top. That is how the verification business is currently built. The 153 million U.S. and Canadian driver's licenses now advertised for sale through a service called Nexus, on a Russian-language cybercrime forum, are the visible proof of what that model produces: a permanent, centralized, exfiltratable record of ordinary consumer life.
The primary reporting is Brian Krebs's. Krebs traced the apparent source of the database to IDScan.net, a New Orleans company that says it processes more than 21 million identity verifications every month at more than 20,000 locations worldwide. IDScan.net's own customer and integration materials name Holiday Inn, 7-Eleven, GameStop, DraftKings, Hertz, Target, FedEx, Shell, and Caesars Entertainment among the brands using its scanners. That is the mechanism by which a single vendor compromise can fan out across thousands of consumer-facing businesses. Krebs also found timestamps on the leaked scans that matched real trips, hotel stays, and rental car bookings where the license holders had physically handed over their IDs, reinforcing the attribution.
The dataset is not a bluff. Spot checks returned Brian Krebs's own license and that of U.S. Defense Secretary Pete Hegseth, plus records for other government officials, Krebs reported. The database grew by roughly 400,000 driver's-license records in about 24 hours of observation, and the operators claim more than a year of continuous exfiltration. Alongside the licenses, the service advertises more than 10 million other ID cards, 3 million-plus travel documents and international IDs, and hundreds of thousands of medical cards: the full document-authentication capture set a vendor would hold, not just a single image. Independent coverage from Malwarebytes and Cybernews confirms the same headline figures and IDScan.net attribution framing; the wire story did not add new facts.
IDScan.net told Krebs it is investigating but has not publicly confirmed its systems were the source. The FBI has opened an investigation through its New Orleans field office. The attribution is a working hypothesis supported by correlation, vendor customer lists, and timestamp matches, not yet a confirmed breach disclosure.
The verification industry is built to retain documents, not to discard them. A customer who scanned a license at a hotel last year should still be verifiable as the same person when they return. The vendor keeps the full high-resolution capture: front, back, infrared, ultraviolet. A one-minute 7-Eleven age check becomes a permanent record on a New Orleans server. A rental car contract becomes a document store entry with anti-forgery fidelity that makes a stolen license far more useful to a fraudster than a blurry photo would be. Coin Center's Peter Van Valkenburgh has tied the incident to a broader policy question: under the current KYC regime, third parties are required to hold the very records that, once centralized, become the target.
Every retail scanner that writes a permanent copy of a consumer's ID to a vendor's document store adds, in real time, a new entry to someone else's inventory. The structural responses are well known: data minimization, retention limits, alternatives to vendor-held document storage, and regulatory pressure on verification vendors to defend against becoming a single point of failure for the U.S. identity layer. None of them work if the default stays "keep everything, forever, in case we need it again."