IDScan Confirms Major Data Breach Affecting Over 150 Million Driver's Licenses

IDScan, a leading ID verification service, has confirmed that it experienced a significant data breach involving the theft of driver’s licenses from its systems. This announcement comes a week after reports indicated that the company had been hacked over the course of a year. The breach reportedly included the theft of full names, driver’s license numbers, and identity numbers from other government-issued documents such as passports.

The Louisiana-based company serves a variety of corporate clients, including entertainment venues and cannabis dispensaries, to verify the identity of their customers. This notice marks IDScan's first acknowledgment of the breach, following an initial investigation into the incident that had not yet confirmed an intrusion.

According to IDScan's website notice, the company received information regarding the hack around September 1, coinciding with a report by cybersecurity journalist Brian Krebs. Krebs highlighted that a dark web site had been discovered, allowing users to search for driver’s license information of over 150 million individuals from the United States and Canada, including access to their photos. He verified the authenticity of the data by checking his own record, which also included information on high-profile individuals.

Final Brief

The Pentagon has acknowledged awareness of the suspected breach, and the FBI is currently investigating the incident. IDScan stated that its investigation is ongoing and emphasized that while full access to the stolen information required payment, it is notifying potentially affected individuals through its website. Although the company has not disclosed the exact number of individuals affected, it noted that it holds records for over 150 million driver’s licenses.

IDScan has not responded to inquiries regarding whether the hackers contacted the company with a ransom demand to prevent the release of the stolen data. As the investigation continues, concerns about the implications of such a large-scale data breach remain paramount, particularly regarding the security of sensitive personal information.