NEW ORLEANS — Federal authorities are investigating whether a massive trove of more than 150 million U.S. and Canadian driver’s licenses and other government-issued identification documents offered for sale on the dark web originated from a New Orleans-based identity-verification company, according to reporting by nola.com and cybersecurity journalist Brian Krebs.
Scope of the alleged leak and the local connection
The firm identified in reports, IDScan (operating as IDScan.net), provides technology used to verify identification for purposes ranging from age-restricted entry and online verification to employee access and counterfeit detection. The company has worked with national brands such as Hertz, FedEx and GameStop, according to published accounts.
Details published in early September by KrebsOnSecurity prompted the FBI to open an inquiry to determine whether the documents circulating on a dark web forum were obtained through unauthorized access to systems tied to IDScan. Krebs reported that the forum temporarily shut down after he published his findings and that the leaked files included a variety of government IDs and related records.
Company response and reported data types
IDScan issued a statement acknowledging that around Sept. 1, 2026, it received information indicating potential unauthorized access to certain data. The company said it immediately took steps to secure its systems and retained outside specialists to assess the incident.
"On or around September 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization. Upon this discovery, we took immediate steps to secure our systems and engaged a team of third-party specialists to help determine the full nature and scope of the incident. This investigation is currently ongoing. While the investigation is ongoing, IDScan.net has determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud. The types of information contained within the affected data may include full names and driver’s license or other government-issued identification numbers. Though full access to the information required payment, in an abundance of caution, we are notifying potentially impacted individuals of this incident and providing access to free credit monitorin"
The company statement, as released, was truncated in the public reporting. Published accounts list the types of documents reportedly being offered on the dark web as including driver’s licenses, medical identification documents and travel IDs.
| Reported items | Notes |
|---|---|
| Driver’s licenses | More than 150 million U.S. and Canadian licenses reportedly appeared for sale |
| Medical IDs and travel IDs | Papers of varying government-issue types were cited in reporting |
| Names and ID numbers | IDScan stated those fields may have been accessed from customer accounts |
Investigative leads and national attention
According to Krebs’ reporting, some high-profile individuals were among the records listed for sale on the forum before it went offline. Krebs named himself as the journalist who first reported the listing and said the forum shut down after his article ran. Krebs also reported that an assistant FBI director and U.S. Defense Secretary Pete Hegseth were among individuals whose information appeared for sale.
The FBI has not publicly detailed the status of its probe beyond confirming it opened an investigation following the reporting. Local authorities in New Orleans have not issued independent statements about the inquiry as of the latest published accounts.
Local consequences and what residents should know
For New Orleans residents and businesses that rely on IDScan’s verification tools, the investigation raises immediate privacy and security concerns. If the data did originate from a cloud-based repository tied to the company, affected individuals could face risks ranging from identity fraud to fraudulent use of credentials for travel or medical purposes.
- Individuals: Monitor financial accounts and official communications for signs of misuse; take advantage of credit monitoring if offered.
- Businesses: Review third-party verification providers and audit access controls; update incident response plans.
- Officials: Federal and local investigators will determine whether the breached records were obtained via IDScan systems or through other means.
The unfolding inquiry highlights the intersection of local tech firms and national security concerns. As investigators continue their work, affected customers and organizations that rely on identity-verification services should expect additional notifications and guidance from both the company and federal authorities.
WE NEWS will follow developments in the investigation and provide updates as official information becomes available.
