Millions of people may have had some of their most sensitive personal information exposed in a major security failure tied to an ID-verification service.
That includes driver's license scans, the kind of data many people only hand over because a company says they must.
In a YouTube video, privacy-focused content creator Techlore said IDScan.net appears to be the source of a database containing 153 million driver's licenses and other identity documents that were being sold on a dark web marketplace called Nexus.
Here's what to know
Techlore said the exposed material went far beyond standard driver's license images.
According to Techlore, the trove also contained medical cards, residency paperwork, employment authorization records, travel credentials, overseas driver's permits, and even infrared and ultraviolet scan data.
What made the allegation especially striking, Techlore argued, is that IDScan.net presents itself as a fraud-prevention company and said it does "ID fraud prevention at scale," even though it appears to have exposed the very documents criminals could use for identity theft.
TCD Picks » Quince Spotlight
💡These best-sellers from Quince deliver affordable, sustainable luxury for all
Citing Bleeping Computer, Techlore said the service was used by businesses including stores, gun dealers, financial firms, cannabis dispensaries, and hospitality venues, while also pointing to Hertz as a major apparent partner.
Nexus was already offline in Techlore's Sept. 5 video, but the creator cautioned that a shutdown does not mean the files are gone. Once identity documents reach criminal marketplaces, they can continue circulating long after a site disappears.
More background
People may be asked for a license scan to rent a car, enter certain stores, use financial services, or verify age online.
Once sensitive documents are collected, people have very little say in what happens to them, and careless storage can leave millions exposed after a single mistake.
Techlore framed the breach as part of the larger age verification debate, warning that expanding mandatory ID checks could both create more attractive targets for attackers and boost demand for stolen IDs from people trying to get around those systems.
One user said, "Every single day I am vindicated for refusing to use ANY website that demands my ID!"
What can be done?
Of the immediate steps available, Techlore emphasized freezing credit to make it harder for criminals to open accounts in someone else's name.
He also recommended basics such as strong passwords, two-factor authentication, and a password manager to limit fallout from related breaches.
Techlore's other advice was to pause before uploading an ID at all. In some situations, he said, a less invasive option may be available, especially one that reveals less personal information, such as a home address.
Techlore said lawsuits had started, and the FBI was investigating as of Sept. 5, but for consumers whose data may already be circulating, that is unlikely to provide much immediate comfort.
Techlore said, "Nobody wants their driver's license online. Just full stop."
The creator added that "we need to be big proponents of avoiding age verification online."
Where can I learn more?
Companies and regulators ask the public to trust them, then clash over how much transparency and accountability they actually owe.
• In India, investigators exposed ghost operations at government-approved e-waste plants meant to recycle safely.
• Drivers say roadside advertisers have made a literal eyesore out of busy highways.
Get TCD's free newsletters for easy tips, smart advice, and a chance to earn $5,000 toward home upgrades. To see more stories like this one, change your Google preferences here.
