IDScan.net Breach Exposes 153 Million Driver's Licenses

A massive data breach at identity verification firm IDScan.net has exposed the scans of over 153 million driver's licenses from the U.S. and Canada. The leak represents a critical failure in the security of government-issued identification data, leaving millions vulnerable to sophisticated identity theft.

Confirmed reports indicate the leaked dataset includes more than 153 million driver's license scans, 10 million state ID cards, 3 million travel documents, and 579,000 medical marijuana cards. The breach is particularly severe because of the depth of the data; each license record included six separate images, featuring front and back shots captured in standard light, infrared (IR), and ultraviolet (UV) spectrums. These multi-spectrum images are typically used by authentication systems to verify the authenticity of a physical document.

The Source of the Leak

IDScan.net, based in New Orleans, is a central pillar of the identity verification industry, performing over 21 million ID checks every month. The company provides services to major corporate clients, including Hertz and FedEx. The breach came to light after cybersecurity researcher Brian Krebs discovered the data being advertised on 'Nexus,' a Russian-language cybercrime marketplace. Krebs noted that the leak included his own and his mother's licenses, with timestamps corresponding exactly to a car rental transaction at Hertz. The Nexus marketplace went offline shortly after the findings were published.

Systemic Risks of Third-Party Verification

This incident underscores a growing systemic risk in the digital economy: the outsourcing of identity verification to third-party vendors. While companies use these services to prevent fraud, the vendors often retain sensitive biometric and government-issued data. Unlike a password or a credit card number, a driver's license is a permanent identifier that is difficult and slow to replace. The exposure of UV and IR images provides bad actors with the exact blueprints needed to create high-quality forged documents that can bypass standard security checks.

Legal and Federal Fallout

The scale of the exposure has triggered immediate legal and federal responses. The FBI's New Orleans field office has opened a formal investigation into the breach. Simultaneously, IDScan.net is facing multiple class-action lawsuits from affected individuals. In a statement, an IDScan spokesperson noted that updates provided during the investigation have been "welcome, and helpful to our team's investigation."

Industry analysts are now watching to see if this breach will force a shift in how identity verification firms store data, specifically whether they will be required to implement stricter deletion policies to ensure that sensitive scans are not retained longer than necessary for a single transaction.