ID verification company IDScan has confirmed that hackers stole driver’s licenses and other government-issued identity information from its systems, turning what was initially a suspected breach into a major data security incident.
The company said an unauthorized third party accessed information stored in its cloud environment. The exposed data can include people’s full names, driver’s license numbers and identification numbers from other government-issued documents, including passports.
IDScan provides identity verification services to businesses, including companies in entertainment, retail and other industries that need to check customers’ government-issued IDs. Until now, the company had only said it was investigating reports of a possible security incident.
The confirmation comes about a week after cybersecurity journalist Brian Krebs reported that a dark web service called Nexus was offering access to a huge database of identity documents belonging to people in the United States and Canada.
Krebs was able to verify that the information was genuine after finding his own driver’s license in the database. The leaked collection reportedly contained more than 150 million driver’s licenses, along with other identity documents and photos. High-profile individuals were also reportedly included in the database.
The FBI has been investigating the incident, while the Pentagon previously said it was aware of reports involving the stolen identity information. The dark web service reportedly went offline shortly after Krebs published his findings.
IDScan said it learned about the alleged breach around September 1 and has since launched an investigation. The company has not disclosed exactly how many people are affected, although it has previously said that its systems contain more than 150 million driver’s license records.
The company also said that full access to the stolen information required payment, suggesting the attackers may have been attempting to monetize the data. IDScan has not publicly confirmed whether it received a ransom demand or whether the hackers contacted the company directly.
The breach is particularly concerning because driver’s licenses and passports contain information that can be used for identity theft, fraud and impersonation. The incident also raises broader questions about how long identity verification companies should retain copies of sensitive government documents and how those records are protected.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
IDScan says its investigation remains ongoing and that it is cooperating with federal law enforcement. For now, the full scope of the breach and the number of people affected remain unclear.
