IDScan, a company specializing in identity-document verification, confirmed that attackers stole data from its cloud systems, including driver's licenses, full names, and license numbers, along with identification numbers contained in other government documents such as passports. The company says the investigation is still ongoing and has not yet determined the actual number of affected individuals.
The confirmation came about a week after reports emerged of a breach that lasted for a year. IDScan initially said it was investigating a security incident but did not confirm at the time that a breach had occurred. In a notice published on its website, the company explained that it received information about an alleged breach on September 1, the same day cybersecurity journalist Brian Krebs published a report about the incident.
What Do Reports Reveal About the Scale of the Data?
Krebs's report stated that a website on the dark web allowed searches of driver's license information for more than 150 million people living in the United States and Canada, with access to their images. The data was verified by examining a record belonging to Krebs himself, while a public figure and a security researcher also confirmed that their data appeared in the database. According to the report, the data included records of prominent figures, including U.S. Secretary of Defense Pete Hegseth.
This does not mean that IDScan confirmed that all of the more than 150 million records belonged to people whose data was stolen in the same incident. The company said only that it retains more than 150 million driver's license records, leaving the actual number of affected individuals unresolved. It also did not clarify whether the attackers obtained all of the data or only part of it.
Why Does This Matter?
IDScan provides its services to customers in multiple sectors, including entertainment venues and cannabis retailers, to verify customers' identity documents. This makes the incident an example of the risks associated with concentrating sensitive identity data among verification-service providers, rather than having each organization retain the data separately. A full name, driver's license number, and image of the document could give attackers a reusable set of data for identity-theft or fraud attempts, although the source does not establish that such uses occurred.
IDScan notified potentially affected individuals through a notice on its website. It said that full access to the information required payment, wording that could indicate a financial demand from the attackers, but the company did not confirm that a ransom demand existed or say that it had communicated directly with them. It also did not respond to TechCrunch's questions on this point.
Investigations and Open Questions
The U.S. Department of Defense said it was aware of the suspected breach, while a spokesperson for the Federal Bureau of Investigation, or FBI, said the bureau was investigating the incident. Key questions remain unanswered, including how long the attackers remained inside the systems, whether images of the documents and complete data were published or sold, and what steps the company will take to notify affected individuals and protect its systems.
Editorial takeaway: The significance of the incident lies in the size of the database and the nature of the information, not in confirmation of a final victim count, which has not yet been issued. Until the investigation is complete, the figure of 150 million should be treated as the volume of records IDScan says it retains, not as a confirmed final tally of affected individuals.