FBI Probes Massive ID Breach While Portland Reviews Custody Death

Avatar photo

ByBen Taylor

September 3, 2026

Federal and local authorities have launched major investigations into a dark-web marketplace claiming 153 million stolen IDs and a fatal police encounter in Portland.

Federal investigators and local law enforcement are navigating the early stages of two distinct but significant accountability probes this week. The FBI’s New Orleans field office has opened a formal investigation into a dark-web marketplace known as Nexus, which recently claimed to possess over 153 million scanned driver’s licenses and government IDs. The suspected source of the data is IDScan.net, a Louisiana-based identity verification firm that provides services to retailers, hotels, and dispensaries. The scale of the breach is described by cybersecurity researchers as unprecedented, particularly due to the high-fidelity nature of the records involved.

According to records and advertisements posted by the marketplace operators, the cache includes high-resolution infrared and ultraviolet scans of IDs, including Common Access Cards (CAC), medical cards, and travel documents. The operators claimed the data was the result of continuous exfiltration over more than a year, at one point adding 400,000 licenses in a single 24-hour period. This suggests an ongoing compromise rather than a one-time data dump. While the Nexus site has recently gone offline following public exposure, showing a notice that the service is no longer available, cybersecurity researchers warn that the underlying data remains in circulation, posing a persistent risk for enterprise fraud, account takeover, and synthetic identity creation.

In a formal incident notice sent to clients, IDScan.net confirmed it received information on September 1 regarding a possible exposure. The firm stated it has activated its incident response plan, engaged external forensics, and notified the FBI. However, the firm explicitly noted it has not yet reached a conclusion regarding the specific scope or types of data involved. This gap in the record is a critical point for future regulatory audits and victim notification requirements, as organizations that relied on IDScan for “Know Your Customer” (KYC) or in-person checks—including major retailers and rental agencies like Hertz—now face potential liability.

Meanwhile, in Oregon, the Portland Police Bureau is treating a September 2 incident as an in-custody death. Members of the Enhanced Crisis Intervention Team (ECIT) responded to a report of a man in crisis at a Southeast Tolman Street address. According to police records, the man had barricaded himself and was stabbing himself. During the encounter, officers deployed at least one Taser. The individual was transported by EMS but died before arriving at the hospital. The cause and manner of death remain pending from the medical examiner, which will be a pivotal piece of evidence in the coming weeks.

The bureau’s Homicide Unit is leading the investigation, and the incident will undergo a mandatory use-of-force review. The case is slated for presentation to the Police Review Board, an oversight body that includes community members and representatives from the Independent Police Review. The Multnomah County District Attorney’s Office has been notified and consulted, and the bureau is currently soliciting witness tips via its homicide tip line. The bureau notes this is an active and ongoing investigation.

As these investigations proceed, the eventual release of primary source materials—ranging from server logs and forensic audits in the Nexus case to bodycam footage and dispatch reports in Portland—will serve as the baseline for determining institutional liability. In both instances, the administrative state’s ability to remain answerable to the public depends on the transparency of these records. The Paper Trail will continue to monitor the Multnomah County District Attorney’s Office and the FBI for further disclosures as these files become subject to public records requests.

Leave a Reply

Your email address will not be published. Required fields are marked *