Identity verification vendor IDScan has confirmed unauthorized access to customer data held in its IDScan.net cloud, following reports linking the company to a dark-web offering of more than 153 million driver's license scans. The company said it became aware of the activity on or around September 1 and issued a security notice on September 4. Its review is continuing while it offers credit monitoring and works with federal investigators.
Disclosure timeline
IDScan published a security notice on September 4 stating that certain data may have undergone access without permission, an event it said it identified on or around September 1. The vendor said it moved to secure its environment and brought in outside specialists to establish the nature and extent of what occurred.
The acknowledgement followed earlier public reporting. On September 1, Brian Krebs reported that a dark-web platform called "Nexus" was promoting query-based access to more than 153 million U.S. and Canadian driver's license scans. On September 4, BleepingComputer reported that multiple lawsuits had been filed against IDScan over claims that attackers had broken in and were offering a database with more than 153 million driver's licenses. IDScan had not at that point publicly confirmed the event and had not answered requests for comment.
TechCrunch later located IDScan's September 4 notification, which carried a noindex directive telling search engines not to index the page.
What data was involved
According to IDScan, the information potentially reached from accounts on the IDScan.net cloud can include full names and driver's license or other government-issued identification numbers. The notice did not mention image files, though reporting on the incident said actors were also able to take scans of driver's licenses.
The Nexus offering described by Krebs was said to extend beyond licenses. It allegedly also held 10 million ID cards, 3 million travel documents, and 579,000 medical cards. Full retrieval from that service reportedly required payment.
Krebs said he checked excerpts from the collection by looking up entries for himself and for other people who had agreed to be searched, and connected the material to IDScan.
Platform and customers
IDScan supplies technology for scanning, authenticating, and extracting data from government-issued identification documents. Its users span car rental companies, retailers, financial institutions, cannabis dispensaries, gun shops, and hospitality businesses, concentrating large volumes of identity records in cloud accounts.
After coverage of the Nexus service circulated, that platform went offline. Reporting noted the operators probably retain a copy of the database. Separately, multiple threat actors have since advertised the complete collection for sale, claims BleepingComputer said it could not verify as legitimate.
Detection and mitigation
IDScan said its inquiry is still underway but has established that an outside party "may" have viewed or duplicated customer information kept in IDScan.net cloud accounts. Despite the paid-access model described for the illicit service, the company said it is alerting people who could be affected "in an abundance of caution" and is supplying free credit monitoring and identity protection services.
The vendor said it started an inquiry immediately, examined its data-security policies and procedures, and is cooperating with federal law enforcement. The FBI had earlier confirmed to BleepingComputer that it was examining the matter. BleepingComputer said it made repeated attempts to obtain answers from IDScan without receiving a reply.
Technical background — general information, not specific to this incident
This section provides general context on this type of breach and does not describe IDScan's architecture or the method used here, which were not disclosed in the supplied material.
Identity-proofing providers typically retain two layers of data: cropped images of front and back documents, and structured fields parsed by OCR and barcode reading such as name and identification number. Aggregation across many merchants makes such repositories high-value targets, because a single intrusion can yield documents usable for impersonation, account takeover, and synthetic-identity fraud.
Generic defensive practices for operators of similar systems include centralized audit logging for bulk reads and exports, least-privilege access to document stores, retention minimization, and alerting on anomalous query volume. A illustrative generic log triage pattern, not tied to this event, looks like:
# generic example only: look for unusual bulk reads in cloud audit logs
grep -E 'ListObjects|GetObject|BatchGet' cloud-audit.log | cut -d' ' -f1,4,7 | sort | uniq -c | sort -nr | head
For potentially affected individuals, commonly recommended general steps include activating offered monitoring, placing fraud alerts or freezes where available, and watching for misuse of name combined with government-issued identification numbers.