Identity verification company IDScan has confirmed that hackers stole driver’s licence information from its cloud systems, following reports of a year-long breach involving data belonging to more than 150 million people in the United States and Canada.
The Louisiana-based company said in a security notice that the stolen information includes full names and driver’s licence numbers, as well as identification numbers from other government-issued documents, including passports.
IDScan provides identity document checking and verification services to corporate customers, including businesses in sectors such as entertainment and cannabis. The company’s latest notice is its first confirmation that its systems were compromised. A week earlier, IDScan said it was investigating a reported security incident but had not confirmed that an intrusion had occurred.
The company said it received information on or around September 1 about a claim that its systems had been hacked. The same day, cybersecurity journalist Brian Krebs reported on a database appearing on the dark web that contained identity document information belonging to more than 150 million people.
Krebs reported that the database allowed searches of driver’s licence records and photographs. He verified the authenticity of the information by checking his own record. The database also reportedly contained information belonging to high-profile individuals, as well as a security researcher who independently confirmed that their details appeared in the data.
The reported scale of the incident has attracted attention from US authorities. The Pentagon told TechCrunch it was aware of the suspected breach, while an FBI spokesperson confirmed that the agency was investigating.
IDScan has not disclosed the exact number of people affected by the incident. The company says it holds more than 150 million driver’s licence records, providing an indication of the potential scale of the data involved.
The company also said its investigation remains ongoing. Its notice indicated that full access to the stolen information required payment, although it has not confirmed whether the attackers made a ransom demand or contacted IDScan directly.
The breach raises concerns because driver’s licence information can contain several pieces of personal data that can be used for identity verification. The reported availability of photographs alongside licence details could add to the potential risks for people whose records were exposed.
IDScan has advised potentially affected individuals through its website while the investigation continues. The company has not yet provided a detailed account of how the attackers gained access to its systems or how long the information may have been exposed.
The incident also highlights the security challenges faced by companies that store large volumes of identity documents on behalf of other businesses. For organisations handling government-issued identification, a breach can expose information that individuals cannot simply replace in the same way they might change a password.
For now, the full scope of the IDScan incident remains unclear, with the company’s investigation and the FBI inquiry still underway.
Dear Reader,
Ledger Life is an independent platform dedicated to covering the Internet Computer (ICP) ecosystem and beyond. We focus on real stories, builder updates, project launches, and the quiet innovations that often get missed.
We’re not backed by sponsors. We rely on readers like you.
If you find value in what we publish—whether it’s deep dives into dApps, explainers on decentralised tech, or just keeping track of what’s moving in Web3—please consider making a donation. It helps us cover costs, stay consistent, and remain truly independent.
Your support goes a long way.
🧠 ICP Principal: ins6i-d53ug-zxmgh-qvum3-r3pvl-ufcvu-bdyon-ovzdy-d26k3-lgq2v-3qe
🧾 ICP Address: f8deb966878f8b83204b251d5d799e0345ea72b8e62e8cf9da8d8830e1b3b05f
Every contribution helps keep the lights on, the stories flowing, and the crypto clutter out.
Thank you for reading, sharing, and being part of this experiment in decentralised media.
—Team Ledger Life
Community Discussion