A dark web marketplace called Nexus is advertising more than 153 million scanned driver's licenses from people across the United States and Canada, along with millions of ID cards, travel documents, and medical cards. The FBI's New Orleans field office has opened an investigation, and the reported trail leads to IDScan.net, a Louisiana-based identity verification company whose hardware and software show up at bars, rental counters, retailers, and dispensaries. For cannabis retailers, this is not a distant cybersecurity story. It is a direct warning about who holds customer ID scans after the age check at the counter is finished.
Why Dispensaries Sit Inside This Exposure
Age verification is non-negotiable in adult-use and medical cannabis retail. Every legal transaction requires confirming a customer is of legal age or holds a valid medical card, and many dispensaries use third-party scanning hardware to do it quickly at the point of sale. The reported IDScan.net customer list includes Planet13, a multi-state dispensary operator, though there is no confirmation that Planet13 customer records specifically appear in the Nexus listing. That caveat matters, but it does not change the underlying exposure: any retailer using a shared verification vendor is only as secure as that vendor's data retention practices, not its own.
Here's the catch that operators often miss. A budtender swiping a license at checkout assumes the scan disappears once the transaction clears. In practice, though, many verification vendors retain copies for compliance recordkeeping, dispute resolution, or system training. That retention turns a single software provider into a concentration point holding scanned IDs from dispensaries, rental agencies, and retailers that otherwise share nothing in common. One compromised vendor can expose the customer base of dozens of unrelated businesses at once.
What Operators Should Be Asking Vendors Now
Seed-to-sale tracking systems like METRC govern inventory and sales compliance, but they say nothing about how long a third-party scanning vendor keeps a copy of a customer's driver's license image. That is a separate contract term, and it is one most dispensary operators never negotiate directly. Multi-state operators managing dozens of storefronts should treat this incident as a prompt to audit every point-of-sale integration and age-verification partner for data retention policy, encryption standards, and breach notification timelines.
- Confirm how long ID-scan images are stored after a transaction, and whether deletion is automatic.
- Ask vendors whether scans are stored in the cloud, and what access controls govern those systems.
- Review breach notification clauses in vendor contracts, since IDScan.net's own disclosure took nine days from initial acknowledgment to confirmed incident.
- Document compliance logs showing which verification tool was used at which register, in case customer notification becomes necessary later.
A Different Kind of Breach Risk
Most retail data breaches involve account credentials or payment card numbers, both of which can be reset. A driver's license cannot be rotated the same way. Replacing one means a DMV visit, a new license number, and in some states a waiting period. That is why security teams treat identity-document leaks as more severe than typical credential breaches, even when the headline record count looks similar to other incidents.
For cannabis retailers specifically, the stakes carry an added layer. Customers walking into a dispensary are already disclosing sensitive information, sometimes including medical cannabis card details tied to a qualifying condition. A leak that pairs a government ID with evidence of dispensary patronage is not just an identity-theft risk. It is a privacy exposure that touches on medical confidentiality, and it is the kind of scenario regulators overseeing medical cannabis programs will likely want addressed in future licensing and data-security rules.
What Remains Unconfirmed
IDScan.net has acknowledged that an unauthorized third party may have accessed customer information, including names and government ID numbers, but the company has not confirmed that all 153 million advertised records originated from its systems. Criminal marketplaces routinely inflate record counts to attract buyers, so the true scope will depend on forensic verification, not the seller's own advertising copy. Dispensary operators should wait for confirmed guidance from vendors and regulators before assuming customer data has been compromised, while still using this moment to tighten contract language and ask harder questions before the next renewal cycle.
