- Published on
ID verification giant IDScan confirms data breach with more than 150 million driver’s licenses stolen
- Authors
- Name
- DeepHorus
IDScan, a Louisiana-based identity verification company, has confirmed a data breach that involved the theft of more than 150 million driver’s licenses. The company acknowledged the incident in a website notice, marking its first public admission after a week of investigation. The stolen data includes people’s full names, driver’s license numbers, and identity numbers from other government-issued documents such as passports.
IDScan provides identity document checking services to corporate customers, ranging from entertainment venues to cannabis dispensaries. The company said hackers stole the records from its cloud systems. This breach is significant because IDScan is widely used to verify customers’ identities, making the stolen data highly sensitive.
The breach first came to light on September 1, when cybersecurity journalist Brian Krebs reported that a dark web site allowed anyone to search the driver’s license information of over 150 million people in the United States and Canada, including their photos. Krebs verified the authenticity of the data by examining his own record. The database also contained high-profile individuals, including U.S. Secretary of Defense Pete Hegseth.
The implications of this breach are severe, as the stolen identity documents could be used for fraud and identity theft. IDScan noted that “full access to the information required payment,” suggesting that hackers demanded money to release the complete cache. The company has not disclosed how many individuals are affected, but its website states it holds over 150 million driver’s license records.
The Pentagon told TechCrunch last week that it was aware of the suspected breach, and an FBI spokesperson said the agency was also investigating. IDScan said its investigation is ongoing and that it is providing notice on its website to notify potentially affected individuals. The company did not respond to TechCrunch’s request for comment on whether hackers made a ransom demand.
Looking ahead, the full scope of the breach remains unclear, and IDScan has yet to confirm the number of impacted individuals. The incident highlights the growing risk of identity document theft and the need for stronger security measures. Authorities are continuing their investigations, and affected individuals may face long-term risks from the exposure of their personal information.
