IDScan has confirmed that hackers stole driver's licenses from its cloud systems, marking the identity verification company's first acknowledgment that it was breached. The Louisiana-based firm said in a website notice that the stolen information includes people's full names and driver's license numbers, as well as identity numbers from other government-issued documents such as passports. IDScan is used by corporate customers ranging from entertainment venues to cannabis dispensaries to check and verify the identity documents of their customers.
The company said it received information on or around September 1 about a claim of a hack, the same day independent cybersecurity journalist Brian Krebs first reported a data breach at IDScan. Krebs reported that he was alerted to a dark web website that allowed anyone to search the driver's license information of more than 150 million people living in the United States and Canada, including accessing their photos. He verified the authenticity of the data by examining his own record. The database also contained high-profile individuals, including U.S. Secretary of Defense Pete Hegseth, and a security researcher who also verified his data for Krebs' report.
The Pentagon told TechCrunch last week that it was aware of the suspected breach, and a spokesperson for the FBI said the agency was also investigating the incident. IDScan had said last week that it was investigating an incident but had not yet confirmed an intrusion. The company said on its website that its investigation is ongoing.
IDScan said full access to the information required payment, likely referring to a demand for money made by the hackers to access the full cache of stolen data. The company said it was providing notice on its website to notify potentially affected individuals. IDScan has not said how many individuals are affected, but notes on its website that it holds over 150 million driver's license records. The company did not respond to TechCrunch's request for comment about the incident, including whether the hackers contacted it with a ransom demand not to release the data.
The breach's scale places it among the largest known exposures of driver's license data in the United States and Canada, affecting a population larger than that of many states. For corporate customers that rely on IDScan for identity checks, the incident raises questions about the security of the document data they routinely submit for verification. For individuals whose licenses were stored in the company's cloud, the exposed records include names, license numbers and photos.
More cybersecurity news from TechManNews.
