ID verification service IDScan has confirmed a data breach involving the theft of driver's licenses from its systems. The confirmation comes one week after cybersecurity journalist Brian Krebs reported that the identity document checker had been breached during a year-long hack.
In a website notice, IDScan stated that hackers accessed its cloud storage to steal full names, driver's license numbers, and identity numbers from other government-issued documents, such as passports. The Louisiana-based company serves corporate customers ranging from entertainment venues to cannabis dispensaries for customer identity verification. This notice marks the company's first acknowledgement of the intrusion; previously, IDScan had only stated it was investigating an incident without confirming a breach.
IDScan indicated it received information regarding the hack claim on or around September 1, coinciding with Krebs' initial report. Krebs described a dark web database allowing users to search the driver's license information of over 150 million people in the United States and Canada, including photos. He verified the data's authenticity by checking his own record, which was present alongside high-profile individuals like U.S. Secretary of Defense Pete Hegseth.
While IDScan noted that full access to the stolen cache required payment—suggesting a ransom demand—the company did not specify how many individuals are affected, though it holds over 150 million driver's license records. The Pentagon acknowledged awareness of the suspected breach last week, and an FBI spokesperson confirmed the agency is investigating. IDScan did not respond to requests for comment regarding whether hackers contacted the company directly.
