Security guide

153 million scanned licenses reported for sale: what to do if you use an ID scanner

Last reviewed September 2026

If you use an ID scanner, you may have read that scans of more than 153 million driver’s licenses were offered for sale.

What was reported

All of the following is as reported by KrebsOnSecurity on September 1, 2026. It is reporting, not a finding, and investigations are ongoing. Nothing here asserts fault on anyone’s part.

• A service calling itself “Nexus,” advertised on the Russian cybercrime forum Exploit, claimed to hold more than 153 million U.S. and Canadian driver’s licenses, among other documents.
• As reported, the license images appear to have come from an identity-verification provider used across several retail and service sectors.
• As reported, the FBI’s New Orleans field office opened an inquiry on September 1, 2026, and the service went offline shortly after the article was published.

KrebsOnSecurity’s September 8 update reports that the provider has since published a notice saying it has “determined that an unauthorized third party may have accessed and/or copied certain customer information, including full names and drivers license or other government-issued identification numbers,” and that it is notifying affected individuals.

What you can do now

1. Check with your vendor. Look for a notice, or ask whether it was affected.
2. Ask what it keeps. The questions below work for any vendor, including us.
3. If your customers’ data may be involved, ask a lawyer whether a notification law reaches your business.

Questions to ask your scanner vendor

1. Do you store images of the ID: front, back, infrared or ultraviolet?
2. Do you keep the full barcode data, or only fields derived from it, such as the age?
3. How long do you keep each kind of data, and what deletes it?
4. Where is it stored, and which other companies handle it?
5. Who at your company can see it, and is that access logged?
6. If there’s a security incident, how and when will you tell me?

For the record: Check ID does not hold a SOC 2 report.

What the law says

California’s breach-notification law, for example, requires a business that conducts business in California and owns or licenses computerized data that includes personal information to disclose a breach to California residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. A business that maintains such data for someone else must notify the owner or licensee “immediately following discovery” (Cal. Civ. Code § 1798.82(a)–(b)).

Some states limit what may be kept from an ID scan.

• Texas amended Alcoholic Beverage Code § 109.61(b) (SB 650, effective September 1, 2025); it now reads, in full, “A person may not retain information accessed under this section.” Subsection (b-1) still describes how retained information may be printed or stored. See our Texas SB 650 guide.
• New Hampshire: under RSA 263:12, X, it is a misdemeanor to knowingly scan, record, retain or store, in electronic form, personal information (as defined in RSA 260:14) obtained from any license, unless authorized by the department. RSA 179:8, III (2025) says nothing prohibits a licensee from scanning an approved ID to verify age for alcohol or tobacco sales, but doesn’t authorize keeping identifying information from it electronically. See our New Hampshire guide.

What Check ID keeps

Check ID is a tool that helps your staff check IDs. It reads what an ID encodes and can’t tell whether a card is genuine. Whether anything below fits the laws above is a question for your lawyer or regulator. No vendor, including us, can promise it will never have a security incident.

• A scan record never keeps the name, date of birth, address, ID number or a picture of the ID, on any plan. We can’t leak what we never kept.
• A scan record keeps details of the check, including the result, the age in whole years, the issuing state or country, the document type, and when and how the ID was scanned. It also keeps the REAL ID indicator as encoded: on Check ID for Teams, and in the free and Pro app from version 3.0. A Teams record also notes the venue, the device and which staff member ran the scan.
• In the free and Pro app, scan history is on by default, covers the last 7 days, syncs through your own iCloud, and can be turned off in Settings.
• Check ID for Teams keeps scan records on our servers for two years by default.
• Guest lists hold names your team adds on purpose.
• Repeat-entry alerts use a one-way code made from what the ID encodes. It’s still derived from personal data, so we never call it anonymous. On the device, codes from barcode scans are cleared once they’re older than 7 days, at the first scan after the app restarts. On Check ID for Teams, our servers may also keep a keyed code, depending on the venue’s location and settings, and delete it after the repeat-entry window (4 hours by default).

Security & data shows what each plan keeps, where it lives and for how long.

Frequently asked questions

Sources

• KrebsOnSecurity, “FBI Probes Service Selling 153M+ Drivers Licenses” (September 1, 2026, updated).
• Cal. Civ. Code § 1798.82.
• Tex. Alco. Bev. Code § 109.61 and SB 650 (2025).
• N.H. RSA 263:12 and RSA 179:8.

All sources retrieved September 2026.