IDScan admits break-in after 153 million driver's license scans surface on dark web
The identity verification firm says an unauthorised party may have copied customer records from its cloud, days after a criminal marketplace advertised access to a huge trove of scanned IDs traced back to the company.
Key points
- IDScan confirmed on September 4 that an unauthorised party may have accessed customer data held in its cloud platform.
- The company detected the intrusion on or around September 1, the same day journalist Brian Krebs linked a dark-web service called Nexus to more than 153 million scanned driver's licenses.
- Exposed information can include full names and driver's license or other government ID numbers, with reports that actual license scans were also taken.
- The Nexus marketplace also allegedly offered 10 million ID cards, 3 million travel documents and 579,000 medical cards.
- IDScan is offering free credit monitoring and says it's cooperating with the FBI, which has confirmed an active investigation.
IDScan, a company that helps businesses check the authenticity of driver's licenses and other government IDs, has admitted that hackers got into its cloud systems and may have copied customer data.
The admission came in a September 4 security notice published with instructions telling search engines not to list it. TechCrunch spotted the hidden notice; it arrived only after a separate story had already tied IDScan to a large cache of stolen IDs on the dark web. We reported on the Nexus marketplace on 1 September, when early evidence pointed at a Louisiana identity verification firm used by car rental counters and cannabis dispensaries.
What was taken?
IDScan says an unauthorised third party may have accessed or copied information stored in accounts on its IDScan.net cloud. That can include customers' full names and driver's license or other government-issued ID numbers.
IDScan's notice doesn't mention scans. But reporting on the breach says criminals also walked away with images of actual licenses, the kind a bar or car rental desk would capture from a real customer.
Where did the 153 million figure come from?
On September 1, security journalist Brian Krebs reported on a dark-web marketplace calling itself Nexus. The site was advertising a searchable database of more than 153 million U.S. And Canadian driver's license scans, alongside 10 million ID cards, 3 million travel documents and 579,000 medical cards. Krebs verified sample records, including one for himself, and traced the data back to IDScan.
Nexus has since gone offline. That doesn't mean the data is gone. Several sellers have since claimed to offer the full database, though none of those sales have been independently confirmed.
Who uses IDScan, and why does that matter?
IDScan's technology sits at the checkout counter of a lot of everyday businesses: car rental firms, retailers, banks, cannabis dispensaries and hotels all use its software to scan the ID a customer hands over, pull out the details and confirm the document is real.
The pool of potentially affected people is wide and hard to pin down. If your license scan passed through the platform in recent years, you may be affected.
Timeline of the incident
| Date | Event |
|---|---|
| September 1 | Brian Krebs reports on the Nexus marketplace and its 153 million license database |
| Around September 1 | IDScan says it discovered the unauthorised access |
| September 4 | Lawsuits filed against IDScan; company publishes a hidden breach notice |
| Ongoing | FBI investigating; multiple sellers claim to offer the stolen database |
Should ordinary people be worried?
Yes, and the window for acting is now. A stolen license scan is more dangerous than a leaked password because you can't change your date of birth or license number. Criminals use these images to open bank accounts or bypass identity checks on other services.
IDScan is offering free credit monitoring to people it believes were affected. If you receive a notice, take it. Beyond that, place a free credit freeze with the major bureaus and treat any unexpected call about a loan or new account as suspicious. Scammers often use real data to make phishing messages, fake emails designed to trick you into handing over more information, look convincing.
The FBI has confirmed it's investigating. IDScan says it has secured its systems and is cooperating with federal law enforcement.
