IDScan confirms breach tied to 153 million stolen driver’s licenses

IDScan, a company trusted to verify sensitive identity documents, failed to prevent unauthorized third-party access to a cloud platform storing over 153 million driver's license scans — one of the most sensitive categories of personally identifiable information (PII). The root cause points to inadequate access controls and insufficient monitoring on cloud-hosted data repositories, allowing a threat actor to exfiltrate an enormous dataset without timely detection. This incident is particularly damaging because driver's license data is largely immutable — victims cannot easily change their license numbers, dates of birth, or physical attributes. It also highlights the compounding risk when identity verification vendors are breached, as their core business model requires holding highly sensitive data at scale, making them high-value targets for cybercriminals.