IDScan confirms breach after hackers offer 153 million driver’s license scans for sale

Identity verification firm IDScan said hackers obtained customer data held in its cloud platform following recent reports connecting the company to a database breach exposing scans of some 153 million driver’s licenses.

The company confirmed a hack in a notice published on its website on September 4 and said it became aware of the breach on or around September 1 — the same day a journalist reported the news based on dark web activity.

“While the investigation is ongoing, IDScan.net has determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud,” the company announcement said. 

“The types of information contained within the affected data may include full names and driver’s license or other government-issued identification numbers.”

IDScan did not say how many customers were impacted.

TechCrunch was first to report IDScan’s security notice confirming the incident. Although the announcement was posted to the company’s website last week, it included a directive to search engines to not index the page, making it difficult to find.

The incident became public when independent cybersecurity journalist Brian Krebs reported that Nexus, a dark web marketplace tied to Russia, was marketing access to more than 153 million driver’s license scans belonging to Canadian and U.S. citizens.

In addition to the driver’s license scans, the hacked database also contained scans of 10 million identification cards; more than three million travel documents and/or international IDs; and at least 579,000 medical cards, Krebs reported.

Krebs authenticated database samples by searching for his and others’ records offered for sale on Nexus and from there tied the hacked data to IDScan.

IDScan did not respond to a request for comment.

The company, which has been hit with several lawsuits in recent days, appeared to downplay the incident in its security announcement by saying the hackers weren’t making the data freely available to bad actors.

“Though full access to the information required payment, in an abundance of caution, we are notifying potentially impacted individuals of this incident and providing access to free credit monitoring and identity protection services,” the company’s notice said.

Businesses rely on IDScan to authenticate government IDs. It is widely used by a range of industries, including cannabis retailers, gun stores and banks.

Identity verification has become controversial, particularly now as lawmakers and lawsuits are pushing social media firms to verify user ages with government ID or other rigorous methods.

The FBI has said it has launched an inquiry into the incident.