In early September 2026, a service called Nexus appeared on a cybercrime forum, offering access to a database of over 170 million identity documents from the US and Canada. The leak originated from IDScan.net, a provider of identity verification solutions. The compromised data included 153 million driver licenses, 10 million ID cards, 3 million passports, and 579,000 medical records.
IDScan.net confirmed that an unauthorized third party accessed and copied information stored in its cloud accounts. Despite the company holding certifications such as ISO/IEC 27001:2022 and SOC 2, the breach highlights the risks associated with storing sensitive data in third-party cloud environments. Investigations into the incident were ongoing as of mid-September 2026.
Recent large-scale data breaches demonstrate that even government agencies and major organizations are vulnerable. In April 2026, France's ANTS agency reported a leak of 12 to 18 million identity records. In the summer of 2026, the Texas Parks and Wildlife Department reported a breach at a third-party contractor affecting over 3 million customers. In May 2025, the UK Ministry of Justice faced a similar attack on its Legal Aid Agency.
Stolen identity documents are increasingly used to train generative AI models, enabling the creation of sophisticated deepfakes and forged documents. This creates a cycle where data leaks fuel more effective fraud, which in turn leads to further breaches. Experts emphasize that identity images should be treated as long-term digital assets rather than temporary files.
To mitigate these risks, companies are shifting toward local document processing. Smart Engines offers the Smart ID Engine, which performs recognition and verification entirely within an organization's secure perimeter. Their Sherlock anti-fraud platform analyzes documents based on over 600 parameters to detect digital tampering without transferring sensitive data to external cloud services.
