IDScan confirms breach exposing more than 150 million driver's licenses

IDScan confirms driver's license data theft

IDScan, a Louisiana-based identity verification provider, has confirmed that hackers stole driver's license data from its cloud environment. The admission, published in a notice on the company's website, is its first acknowledgement of an intrusion, and it comes roughly a week after security journalist Brian Krebs reported that the firm had been hit by a year-long hack.

According to TechCrunch, the stolen material includes individuals' full names and driver's license numbers, along with identity numbers taken from other government-issued documents such as passports.

How the breach came to light

IDScan said it received word of a claimed hack on or around September 1 — the same day Krebs first published his report. Until this week's notice, the company had only said it was investigating an incident and had not confirmed that an intrusion had taken place.

Krebs reported being alerted to a site on the dark web that allowed anyone to search the driver's license information of more than 150 million people living in the United States and Canada, including access to their photos. He verified that the data was genuine by looking up his own record. The database reportedly also contained records of high-profile figures, including U.S. Secretary of Defense Pete Hegseth, as well as a security researcher who confirmed his own entry for Krebs' story.

The Pentagon told TechCrunch it was aware of the suspected breach, and an FBI spokesperson said the bureau is also investigating the incident.

The company's response so far

IDScan says its investigation is ongoing. In its notice, the company stated that "full access to the information required payment" — a phrase TechCrunch interprets as a likely reference to hackers demanding money before unlocking the complete cache of stolen data — but said it is publishing the notice to inform potentially affected individuals.

The company has not said how many people are affected. However, its website notes that it holds more than 150 million driver's license records, which gives a sense of the possible ceiling. IDScan did not respond to TechCrunch's request for comment on the incident, including on the question of whether the attackers had contacted the company with a ransom demand in exchange for not releasing the data.

Why it matters

IDScan sits in a largely invisible layer of the consumer economy. Its corporate customers — which, according to TechCrunch, range from entertainment venues to cannabis dispensaries — use the service to check and verify the identity documents of their own customers. That means people who simply had their license scanned at a venue or point of sale may have no idea their data ever passed through IDScan's systems, and no direct relationship with the company that lost it.

Driver's license records are a dense form of identity material: a name tied to a unique government-issued number, plus document scans and photos. That combination is precisely what is useful for identity theft, account recovery fraud and convincing impersonation — and unlike a password, a license number cannot be rotated after a breach.

The scale compounds the problem. A breach touching a database of more than 150 million records across two countries would rank among the largest identity-document incidents ever reported, and it involves data that cannot be replaced. With the FBI investigating and the full dataset apparently still behind a payment wall, two open questions now matter most: whether the attackers release or sell the data outright, and whether IDScan moves beyond a general website notice to individually notify the people whose records were taken.