Identity firm IDScan breach exposes scans of 153 million driver's licenses

Identity-verification company IDScan confirmed that attackers accessed customer data in its cloud, behind a dark-web marketplace offering scans of more than 153 million US and Canadian driver's licenses, plus names and government-ID numbers. IDScan authenticates government IDs for businesses ranging from banks to car-rental agencies to cannabis and gun retailers, which makes it an aggregator of everyone's identity documents and a single point of mass failure. Investigative journalist Brian Krebs traced the marketplace back to IDScan by matching document scans to occasions when IDs were presented. The FBI is investigating and lawsuits have been filed. Because these are scanned government IDs, victims cannot simply rotate a leaked driver's license.

Check

People who presented IDs to businesses using IDScan should watch for identity and document fraud and use any offered monitoring, and organizations should reassess how much identity-document data their verification vendors retain.

Affected

Roughly 153 million people whose driver's license scans, names, and government-ID numbers were exposed through IDScan; scanned identity documents enable durable document fraud a victim cannot undo by changing a password.

Fix

For organizations, minimize retained identity-document images, encrypt and tightly access-control them, vet identity-verification vendors as high-value aggregators, and prefer verification methods that avoid storing reusable copies of government IDs.