Florida Highway Safety Agency Hit by Cyberattack Linked to International Criminal Group On September 4, 2026, the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) detected a data breach tied to an international cybercriminal organization. The agency swiftly contained the incident, confirming no ongoing breach, and launched an investigation in coordination with the Florida Digital Service and the Florida Department of Law Enforcement. Authorities determined that the attackers exploited credentials belonging to a Plant City Police Department employee, whose login information was improperly stored on a personal device. While FLHSMV notified the Florida Attorney General’s Office as required by state law, details about the scope of exposed data or the number of affected individuals remain undisclosed. The incident is part of an active criminal investigation, with FLHSMV stating that further updates will be released at a later time. No additional specifics on the breach’s impact or the cybercriminal group involved have been provided.

New Orleans-Based Identity Verification Firm Linked to Massive Driver’s License Data Breach A New Orleans tech company, founded in 2003 by Russian immigrants Denis Petrov and Andrey Stanovnov, has come under FBI scrutiny following reports that data from over 150 million U.S. and Canadian driver’s licenses was exposed for sale on the dark web. The firm, which specializes in identity verification for industries like hospitality, finance, and secure facility access, serves nearly 4,000 customers, including major brands such as Hertz, GameStop, AMC Theatres, and Shell. The company, which processes 22 million scans monthly across 30,000 North American locations, expanded from its early focus on age verification for bars and hotels to advanced fraud prevention services. Despite its growth generating tens of millions in annual revenue and employing 150 people globally its New Orleans headquarters remains at the LSU Research & Technology Park ("The Beach"). Cybersecurity journalist Brian Krebs first reported the potential breach, suggesting attackers may have been "siphoning" data from the firm’s systems. The FBI’s New Orleans Field Office confirmed an ongoing investigation but declined further comment. Company officials, including spokesperson Jillian Kossman, acknowledged the reports as part of their internal review but provided no additional details. The firm’s leadership has seen recent changes, with Mike Eckert, former CEO of The Weather Channel, serving as chairman. Petrov, one of the co-founders, has since left the company. The incident underscores the risks in the $14 billion global identity verification market, where sensitive government-issued documents are increasingly targeted by cybercriminals.

Dark Web Identity Theft Service Exposes 153 Million Drivers Licenses in Massive Breach A newly launched dark web service, Nexus, is selling digital scans of over 153 million drivers licenses from the U.S. and Canada, along with 10 million ID cards, 3 million travel documents, and 579,000 medical cards. The breach, first reported on August 31, appears to stem from a Louisiana-based identity verification company, idscan.net, which processes IDs for major corporations, including Hertz, Target, FedEx, and Caesars Entertainment. Investigations by KrebsOnSecurity revealed that the stolen data includes high-resolution scans of licenses some with infrared and ultraviolet imaging alongside timestamps matching when victims rented cars, visited dispensaries, or passed through security checkpoints. Multiple individuals whose licenses were found in the database confirmed they had shared their IDs with Hertz or marijuana dispensaries around the recorded dates, suggesting idscan.net as the likely source. The service, advertised on the Russian cybercrime forum Exploit, claims to have been exfiltrating data for over a year, with records continuously updated nearly 400,000 new licenses were added in just 24 hours. The FBI’s New Orleans field office has launched an official inquiry into the breach, following reports that the service also listed the assistant director of the FBI’s license among its offerings. Security researchers warn the breach poses severe risks, including identity theft for financial fraud, stalking, and threats to protected individuals such as those in witness protection or fleeing domestic violence. The exposed data could enable AI-powered facial recognition to track victims even if they alter their appearance. idscan.net, which processes 21 million verifications monthly across 20,000 global locations, acknowledged the investigation but has not provided further details. Shortly after the story broke, the Nexus website was taken offline, though the full scope of the breach remains unclear. Updates will follow as the investigation progresses.

Nexus Data Breach Exposes Millions of North American Identity Documents A newly emerged cybercrime service, Nexus, has surfaced on a Russian-language forum, offering for sale high-resolution scans of over 153 million U.S. and Canadian driver’s licenses, alongside 10 million ID cards, 3 million travel documents, and 579,000 medical cards. Among the leaked records was a driver’s license scan allegedly belonging to U.S. Defense Secretary Pete Hegseth, though the authenticity of the data remains unverified. Nexus claimed the breach stemmed from a year-long intrusion into Idscan.net, a major identity verification provider serving Fortune 500 companies, retailers, financial institutions, and cannabis dispensaries. Idscan.net, which processes 21 million verifications monthly across 20,000+ global locations, uses specialized hardware to scan IDs via infrared, ultraviolet, and standard imaging. Its client list includes Hertz, Target, FedEx, Motorola Solutions, Jack Henry, Caesars Entertainment, and Planet13, a cannabis chain operating in 19 U.S. states. The breach highlights growing risks as Real ID-compliant licenses required for domestic air travel since May 2025 become central to financial and security verification. Security experts have long warned that the expansion of third-party identity verification systems creates high-value targets for cybercriminals. The FBI has not publicly commented on the investigation, and Idscan.net has yet to issue a statement. The Nexus site was later taken offline, with its login page replaced by a message stating the service was "no longer available." The incident underscores the vulnerabilities in centralized identity verification infrastructure.

IDScan Data Breach Exposes Sensitive Personal Information of U.S. and Canadian Residents A significant data breach at IDScan, a Louisiana-based identity verification company, has exposed sensitive personal information belonging to residents of the United States and Canada. The compromised data reportedly includes driver’s license numbers, passport details, photographs, names, and contact information, raising concerns about identity theft and fraud. The breach came to light after cybersecurity journalist Brian Krebs was alerted to a dark web link containing a database of stolen records. Among the exposed data were details linked to Krebs himself and several high-profile individuals in technology, entertainment, and politics. While unauthorized access may have occurred as early as 2025, the full extent of the breach only gained widespread attention recently. IDScan provides identity verification services to businesses, including those in entertainment and tech sectors, where customers often submit official IDs for access to restricted services. The exposure of such data poses serious risks, as cybercriminals can combine leaked information such as names, addresses, phone numbers, and identification numbers to create detailed victim profiles for phishing, social engineering, and financial fraud. The FBI has confirmed it is investigating the incident, working to determine the scope of the breach, how the data was accessed, and the duration of unauthorized exposure. The agency’s involvement underscores the severity of the leak, particularly given the sensitivity of driver’s license information, which can be exploited for impersonation and targeted scams. The breach highlights vulnerabilities in how companies handle identity verification data and the potential consequences when such information falls into the wrong hands. With cybercriminals increasingly leveraging leaked data alongside publicly available details, the incident serves as a critical reminder of the risks associated with large-scale personal data exposure.