ID verification service IDScan confirms that a data breach involved the theft of driver's licenses from its systems after hackers offered 153M licenses for sale

Driver's license and government ID numbers are now exposed from a third-party verification service, increasing risks of identity theft and fraud. Your identity verification for services may be compromised, requiring heightened vigilance for fraudulent activity. This breach raises concerns about the security of personal data held by vendors used by businesses.

IDScan, a major identity verification service, has confirmed a significant data breach impacting over 150 million driver's licenses. Hackers gained access to IDScan's cloud systems, stealing full names and driver's license numbers, along with other government-issued identity details such as passport information. The company, which serves various businesses including entertainment venues and cannabis dispensaries for customer identity checks, first acknowledged the incident after cybersecurity journalist Brian Krebs reported a dark web site offering the stolen data for sale. Krebs verified the authenticity of the compromised information, which included records of high-profile individuals. The FBI and the Pentagon have confirmed their awareness and ongoing investigations into the breach. IDScan stated that while full access to the data apparently required payment, they are providing notification to potentially affected individuals as their own investigation continues.

The sheer volume of stolen driver's licenses, exceeding 150 million, highlights a critical vulnerability in the supply chain of identity verification services. Companies like IDScan, which act as gatekeepers for sensitive personal data, are becoming high-value targets. This incident suggests that the current security measures and contractual obligations for third-party data processors may be insufficient to protect the vast amounts of personally identifiable information they handle, potentially necessitating stricter regulatory oversight and vendor auditing protocols.

The compromise of such a large dataset of government-issued identification numbers signifies a new level of risk for consumers and businesses alike. It could lead to a surge in sophisticated phishing attacks and synthetic identity fraud, as criminals now possess foundational elements for creating fake identities or impersonating individuals. Businesses relying on IDScan or similar services may face increased scrutiny and potential liability, prompting a re-evaluation of their third-party risk management strategies and data security postures.