Somewhere in a dealership finance office today, a customer will hand over a driver’s license so the F&I manager can run a quick identity check before signing loan paperwork. Nobody thinks twice about where that scan goes, who stores it, or for how long. This week, we found out. It goes to a company most car buyers have never heard of, and that company just got robbed of scans going back more than a year.
Independent security researcher Brian Krebs reported that a new dark web marketplace called Nexus is selling digital scans of more than 153 million U.S. and Canadian driver’s licenses, along with millions of ID cards, travel documents, and medical cards. Krebs traced a cluster of the stolen files to IDScan.net, a Louisiana-based identity verification company. The FBI’s New Orleans field office confirmed it opened an investigation into the apparent breach. The marketplace disappeared from the dark web within a day of the story running.
Here’s the detail that should stop car buyers cold. The machines doing this scanning aren’t cheap barcode readers glancing at the stripe on the back of a license. IDScan.net’s own marketing describes technology that reads infrared and ultraviolet security features and cross-matches microprints, the same class of forensic document reader used by TSA and border agents. Every swipe produces a permanent digital file: front, back, and multiple wavelengths of light. Not a glance. A capture.
Most coverage of this breach has focused on rental counters, since Krebs traced several leaked scans back to Hertz transactions by timestamp. That’s real, and worth knowing if you’ve rented a car recently. But the detail that matters most for this publication’s readers is sitting right on IDScan.net’s own website: the company explicitly lists Automotive as one of its named industry verticals, alongside logistics, finance, hospitality, gaming, and retail. Car dealerships aren’t incidental to this vendor’s business. They’re a category.
Dealerships have two separate reasons to run a license through a scanner like this. One is old-fashioned theft prevention: stores that hand keys to strangers for test drives have been burned enough times that scanning an ID before a loop around the block is now common practice. The other is regulatory. Federal rules that treat auto dealers as creditors when they arrange financing require identity-theft prevention checks before a loan gets signed. Both reasons point to the same moment: a license, scanned, at the exact point where a car changes hands or a loan gets originated.
That regulatory backstop looks a lot less reassuring once you see how loosely these vendor relationships actually get tracked. After Krebs’s story ran, Caesars Entertainment told him it had not been an IDScan.net customer and hadn’t used the company’s VeriScan product since February 2025, despite still being listed as a client on IDScan.net’s own site. IDScan.net said the incident should have no impact on Caesars. Maybe so. But if a company can still be marketed as a client a year and a half after the relationship reportedly ended, the more uncomfortable question for any dealership using a vendor like this is how long its own customers’ scans keep circulating after the contract is over.
Larry Baldwin, a researcher at the cybersecurity firm Cybera who found his own leaked license tied to a rental car timestamp, pointed out why this matters beyond travel plans. Driver’s licenses, he told Krebs, are “commonly used as proof of one’s identity when opening new lines of credit.” A car loan is exactly that. A leaked scan doesn’t just risk a stranger’s vacation, it hands someone the exact document a finance office treats as reliable proof that a buyer is who they claim to be.
None of this is happening in isolation. Cars keep collecting more digital footprints than the rules meant to secure them can keep up with. Security researchers at Black Hat this year showed how an EV charger’s software could reach into a car and everything plugged in nearby. Congress is still arguing over who controls a vehicle’s own diagnostic data under the pending REPAIR Act. A Quebec regulator’s report already catalogued how little say drivers get over the data their own cars collect. Add a license scan sitting in a third-party vendor’s database to that list, and the pattern is hard to miss: the car business has quietly become a data business, without the data-security habits to match.
This publication has spent plenty of time this year on how much a dealership’s paperwork can hide, whether it’s a store faking certified inspections or a lender discovering the same car financed twice. Those stories are about dealers exploiting the trust built into their own paperwork. This one is different. It’s about the paperwork’s own supply chain, the vendor a dealership never has to name to its customers, getting exploited instead.
The scanner at the finance desk did exactly what it was built to do: capture, verify, store. Nobody built a plan for what happens when the company holding all of it gets robbed instead of the dealership. That’s the real story here. Not one rental counter in Louisiana, but a car-buying process that now runs through data pipelines nobody in the showroom controls, and that almost nobody outside a security researcher’s inbox ever hears about until it’s already gone.