ID Verification Firm IDScan.net Confirms Data Breach Affecting 153 Million Driver's Licenses
IDScan.net has confirmed a significant data breach impacting over 153 million U.S. and Canadian driver's licenses, with the stolen data reportedly appearing for sale on the dark web.
ID verification company IDScan.net has confirmed a major data breach that may have exposed the personal information of over 153 million individuals across the United States and Canada. The compromised data includes driver's licenses and other government-issued identification details, which have reportedly been offered for sale on the dark web.
The company disclosed the incident in a notice dated September 4, stating that an unauthorized third party may have accessed or copied records stored in its clients' IDScan.net cloud accounts. The breach came to light as the FBI investigates the sale of these records, which were first identified by security journalist Brian Krebs of KrebsOnSecurity. The FBI's New Orleans field office has reportedly opened an investigation into the matter.
While IDScan.net acknowledged the potential access to names and associated license or ID numbers, the company's disclosure leaves several critical questions unanswered. The notice does not specify the exact number of individuals affected, the initial point of entry for the attackers, or the timeframe during which the unauthorized access occurred. Furthermore, the company has not commented on whether images of the compromised identification documents were also exfiltrated.
IDScan.net stated that it was first alerted to the issue around September 1, after which it took steps to secure its systems and engaged third-party forensic investigators. The company is currently in the process of notifying potentially affected individuals and is offering complimentary credit monitoring and identity protection services. A dedicated toll-free hotline has also been established to address customer inquiries.
In response to the incident, IDScan.net has reviewed its internal data security policies and is cooperating with federal law enforcement agencies. The company advises individuals to remain vigilant, monitor their credit reports and financial statements for any suspicious activity, and consider placing fraud alerts or credit freezes with the major credit bureaus. Resources from the Federal Trade Commission for identity theft victims are also being provided.
The potential impact of this breach is significant, as stolen driver's license information can provide cybercriminals with a wealth of usable identity data for an extended period. Unlike passwords or credit card numbers, driver's licenses often remain valid for many years, offering attackers a long window for potential misuse.
IDScan.net's VeriScan platform is utilized by a wide range of businesses for identity scanning, document verification, age checks, and access management. Its client base spans industries such as banking, casinos, educational institutions, logistics, and law enforcement agencies. The company also offers tools for facial recognition and deepfake fraud prevention.
The confirmation of this breach underscores the persistent threat posed by data theft targeting sensitive identification documents, highlighting the critical need for robust security measures in identity verification services.