On September 1, the security journalist Brian Krebs reported the existence of a dark-web marketplace called Nexus that claimed to be selling digital scans of more than 153 million driver's licenses from the United States and Canada, along with roughly 10 million identity cards, 3 million travel documents, and more than half a million medical cards. Krebs found his own Virginia license in the database. A listing for the US Secretary of Defense's license was priced at $100. The FBI has confirmed that it is investigating.

Krebs traced the likely source to IDScan.net, a Louisiana-based identity verification company whose scanning technology is used by businesses in the automotive, banking, hospitality, retail, and cannabis industries. IDScan has said it is investigating and has not confirmed a breach. Even so, at least five proposed class actions were filed against the company within days, before any formal breach notification had gone out.

This is likely one of the largest identity-document breaches on record. The records Krebs examined went well beyond names and numbers. Each contained multiple image files: front and back photographs of the physical license, including the infrared and ultraviolet scans that verification systems use to check security features.

Why is there a permanent image archive?

When a car rental agency, hotel, or dispensary scans a license, it is trying to answer a small question: is this document genuine, is it currently valid, and is the holder old enough? The answer amounts to two or three bits of information. The systems built to produce that answer collect the entire document, including the image, name, address, date of birth, and license number, and in many deployments they retain all of it indefinitely.

Law firm investigations and press reports name customers of Hertz, Target, FedEx, and Caesars Entertainment among the potentially affected, along with patrons of more than a thousand cannabis dispensaries. These companies outsourced a routine compliance task to a vendor who then built a national archive.

The breach makes plain that enterprises no longer control who has access to their data. Every outsourced data operation, whether it is identity verification, payroll, benefits administration, or marketing analytics, places a copy of sensitive information inside someone else's security perimeter. IBM's 2026 Cost of a Data Breach report found that supply chain compromise, in which a business partner becomes the attack path, adds more to the cost of a breach than any other single factor. The same report put the average cost of a US breach at $11.5 million. Breaches at this scale cost far more than the average. Equifax, whose 2017 breach affected a comparable 147 million people, ultimately spent well over a billion dollars, including a settlement of up to $700 million with US regulators.

There is also no way to undo the exposure. A stolen password can be changed; the name, birth date, address, and document number on a license cannot, so the data in this set will remain usable for identity fraud for years. There is a further problem specific to this case: the contents of a license scan are exactly what a fraudster needs to pass the identity checks that banks and government agencies rely on. A breach at a verification company degrades trust in verification itself.

Familiar remedies are not useful here

Responses to a breach like this usually take one of two forms. The first is to regulate retention: require vendors to delete scans, encrypt archives, and harden their systems. This has a poor track record. Stored data has commercial value, retention rules are difficult to audit, and two decades of breach history show that a sufficiently valuable archive eventually attracts a sufficiently motivated attacker. Once a perimeter fails, whatever was inside it is gone.

The second is to centralize verification with the government, so that instead of vendors keeping scans, terminals would query a state database in real time. Centralization solves the vendor problem and introduces new ones. Government databases have not proven to be safer custodians. The US Government OPM breach included 22.1M records with PII related to security clearances. India's Aadhaar system, the largest national identity database in the world, reportedly suffered a breach exposing more than a billion records. A real-time government ID-check service also produces something else: a central log of every bar, hotel, dispensary, and clinic at which every citizen presents identification. A system designed for fraud prevention would generate a national movement ledger as a side effect.

Some governments are also introducing digital IDs in smartphone wallets, which let a citizen prove a fact such as "over 21" without handing over a full document. Digital IDs are a genuine improvement. They also require every citizen to adopt a smartphone credential and they do nothing for the hundreds of millions of plastic licenses in circulation today.

Verifying without collecting

There is an architecture that answers the verification question without creating the archive, and without creating the government log either. It rests on a branch of cryptography called fully homomorphic encryption, or FHE, which allows a computer to perform calculations on encrypted data without decrypting it. The result of the computation comes back encrypted as well, readable only by the party holding the key. FHE has existed since 2009. What has changed recently is that purpose-built hardware makes it fast enough for production use.

On Niobium's Fog, an encrypted cloud platform built on FHE, license verification works as follows.

• The scanner checks the physical document locally, reading the barcode and examining template and security features on the device. The image is processed on the device, and must not be and is not transmitted anywhere, and not stored.
• The terminal sends a single encrypted question to the Fog, which amounts to asking whether this license number is currently valid. The question is encrypted on the device, and only the device holds the key. The Fog holds no private key material at all.
• The registry inside the Fog contains no images, names, addresses, or photographs. It holds anonymized identifiers and validity flags supplied by the issuing authority, and nothing else.
• The Fog computes the answer directly on the encrypted data and returns an encrypted result, valid or not, of age or not. Only the terminal can decrypt it.

Each party in this arrangement learns a different, limited amount. The vendor only learns whether the license is valid and whether the holder is of age. The platform operator learns nothing about who was checked or where. The government learns nothing about where its citizens present identification. An attacker who steals everything the Fog contains, including the registry and all of the traffic passing through it, obtains anonymized validity flags and ciphertext. Nothing in that haul could be sold on Nexus, because the images and personal details were not collected in the first place.

The issuing authority still holds the primary license database, which must still be protected. What changes is that verification no longer requires copying it into vendor archives or opening it to outside queries and internally, the number of people who have access to the primary database can be tightly restricted.

This is not just stronger security wrapped around sensitive data. The sensitive data is absent. The security rests on well-studied lattice mathematics, the same family selected for post-quantum standards. The workload runs today on mistic Core FPGAs in the Niobium Fog and the mistic ASIC will extend the same architecture with up to a 15x speed improvement over GPUs.

What this means for a nation

License verification is one example of a pattern that repeats across government. Health records, benefits eligibility, tax data, know-your-customer checks, and biometric matching all share the same requirements: many parties need answers and no one needs the raw data. Today's solutions pass the raw data around anyway. Each of these workloads can be restructured the same way the license check was.

A government that adopts this architecture gains more than compliance with privacy law. It makes the dominant category of national data breach, the theft of citizen data from the vendors and service providers entrusted with it, architecturally impossible rather than merely less likely. It can tell its citizens, and foreign investors, that no vendor, platform, or cloud operator processes sensitive national data in readable form, and that readable copies exist only in the systems of record the government already protects. Because the underlying cryptography is post-quantum, the same architecture also addresses the "harvest now, decrypt later" strategy in which adversaries collect conventionally encrypted data today in order to decrypt it once quantum computers mature.

The case for acting now

In late August, more than 100 technology companies, including Microsoft, Google, AWS, and Anthropic, signed an open letter organized by OpenAI warning that "AI-enabled cyber attacks will become far more widespread and sophisticated." Their prescription is to defend faster, and it is sound as an initial, partial solution. It is also a treadmill, because attackers equipped with AI get faster too. The durable complement to faster defense is to build systems in which a successful breach yields nothing of value.

The 153 million license scans offered for sale on Nexus were collected to answer a question that could have been answered without them. Whether the next archive of this kind gets built is an architectural choice, not a cost of doing business.

License verification and workloads like it run in the Fog today, and developer access is open at niobium.co. For governments interested in a sovereign Fog deployment, built and operated for your nation, contact us. A technical white paper describing the verification architecture in detail is available for engineering teams.