ID verification giant IDScan confirms data breach with more than 150 million driver’s licenses stolen

ID verification provider IDScan has publicly confirmed that attackers accessed and removed driver’s license records from the company’s cloud storage. According to a notice on its website, the stolen data includes individuals’ full names, driver’s license numbers and identity numbers from other government-issued documents such as passports.

The confirmation follows reporting by independent cybersecurity journalist Brian Krebs, who said a dark-web site offered a searchable database containing data for more than 150 million people in the United States and Canada, including photos. Krebs said he validated the dataset by locating his own record; the cache reportedly included high-profile entries such as U.S. Secretary of Defense Pete Hegseth and a security researcher who also confirmed his information.

IDScan, a Louisiana-based firm whose identity-checking tools are used by businesses from entertainment venues to cannabis dispensaries, said its investigation is ongoing. The company noted it learned about a claim of a hack on or around September 1 and that "full access to the information required payment," language that appears to reference a demand tied to access to the stolen files. IDScan has not specified how many individuals were affected and did not respond to TechCrunch’s request for comment about whether a ransom demand was made.

Federal authorities have taken notice: the Pentagon told TechCrunch it was aware of the suspected breach, and the FBI said it is investigating. The scale and sensitivity of the exposed records prompted IDScan to post a notice to alert potentially affected people while its inquiry continues.