IDScan Confirms Data Breach Involving Driver’s License and Passport Data

IDScan has confirmed a data security incident involving customer identity information stored in its cloud, days after a cybersecurity report linked the company to a dark-web service offering access to more than 153 million driver’s license records from the United States and Canada.

In its data security notice, the Louisiana-based identity verification company said it learned around Sept. 1 that someone may have accessed certain information without authorisation. IDScan said an unauthorised third party may have accessed or copied customer information including full names, driver’s license numbers and numbers from other government-issued identification documents.

The company has not disclosed how many people were affected. IDScan said its investigation remains ongoing and that it is cooperating with federal law enforcement.

A dark-web service claimed more than 153 million licenses

The incident first drew attention when cybersecurity journalist Brian Krebs reported on a dark-web identity theft service offering searchable access to vast numbers of identity documents. KrebsOnSecurity reported that the service claimed to hold more than 153 million driver’s license records from people in the U.S. and Canada, along with millions of other identification and travel documents.

Krebs verified some of the material by finding his own driver’s license data and checking records belonging to other individuals. The report also said the database included records associated with high-profile government officials.

The FBI opened an investigation into the apparent breach, while the Pentagon said it was aware of the incident. IDScan initially said it was investigating, then later publicly acknowledged the unauthorised access.

IDScan processes identity documents at large scale

IDScan provides identity verification technology to businesses across industries including hospitality, cannabis, retail and transportation. Its systems scan and authenticate driver’s licenses, passports and other identity documents.

The company’s own 2025 ID Fraud Report said it analysed more than 150 million ID scans conducted during 2024, illustrating the scale at which its technology processes identity information. That figure is separate from the number of individuals potentially affected by the current breach, which IDScan has not disclosed.

IDScan said full access to the stolen information being offered online required payment. The company is notifying potentially affected individuals and offering free credit monitoring and identity protection services while its investigation continues.

The incident is particularly sensitive because driver’s license and passport information can contain persistent identifiers that are difficult or impossible for individuals to change. IDScan has advised affected people to monitor their credit reports and financial accounts for signs of identity theft or fraud.