IDScan Breach Exposes Data Behind 150 Million Scanned IDs

An identity verification company that scans driver's licenses for bars, dispensaries, and rental counters has confirmed a breach that exposed the data behind more than 150 million scanned IDs. IDScan.net posted a notice on September 10 after security researchers flagged the intrusion near the start of the month. A criminal marketplace listing has since offered up to 170 million scanned identity documents for sale. Those totals are what has been reported so far and may rise as investigators work through what was taken.

What makes this one hit close to home is who ends up scanned. If you have ever handed your license to a doorman, a dispensary, or a rental desk that ran it through a reader, your record may sit in a system like this one. IDScan says the stolen information includes full names, driver's license and other government ID numbers, and in many cases the license photos and raw document images that its business clients stored in the cloud. That is the core of your legal identity. You cannot reset a license number the way you reset a leaked password.

As it stands, the Louisiana-based vendor is cooperating with federal law enforcement and the FBI is investigating. The company is offering affected people free credit monitoring and identity protection. Reaching the full set of records reportedly takes payment, which slows casual snooping but does nothing to stop a determined buyer. Attorneys are already preparing class actions against the businesses that asked customers to scan an ID in the first place.

For a prepared household, a leak like this is the case for guarding your identity the way you guard your front door. Freeze your credit at all three bureaus so a stolen license number cannot open a new account in your name, and add a fraud alert while you are there. Watch closely for the phishing emails and scam calls that tend to follow a breach, because someone holding your real name and license number sounds convincing on the phone. A steady habit of digital OPSEC keeps one exposed record from becoming a drained account.

The wider lesson is that your information now lives in dozens of systems you never picked, from the reader at the liquor store to the vendor behind it. You cannot pull your license back out of every database, but you can shrink what you expose from here on and learn how not to be tracked online. Ask why a business needs to scan your ID, and whether it stores the image or only checks your age. Set the credit freezes and read your bank and card statements this week. Those few steps turn a scary headline into one short afternoon of work. Be Prepared Not Scared.