IDScan confirms breach after 170M identity documents put up for sale

New Orleans-based ID verification provider IDScan.net has acknowledged the major breach of one of its databases, that exposed more than 170 million scanned identity documents, including 153 million driver’s licenses.

A statement from the company says that “on or around September 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization.” More than that, “an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud. The types of information contained within the affected data may include full names and driver’s license or other government-issued identification numbers.”

IDScan, widely known for its VeriScan age and identity check software, says that an investigation is ongoing, and offers free identity protection and credit monitoring services for “potentially impacted individuals.”

“In response to this incident, we immediately began an investigation and reviewed our policies and procedures related to data security. We are also cooperating with federal law enforcement on their investigation.”

New breach raises questions for industry

The incident is likely to intensify scrutiny of how identity verification providers store customer data after onboarding is complete. Reporting by cybersecurity journalist Brian Krebs suggested the dark web marketplace was receiving newly stolen records in near real time, indicating what appeared to be an ongoing compromise rather than a one-time data dump, though the full scope and mechanics of the breach remain under investigation.

The massive breach will undoubtedly renew debates over data minimization, retention policies and whether encrypted document vaults and tokenized identity records should replace long-term storage of raw identity images.

There will be inevitable fallout for both IDScan.net, as the incident could bring regulatory scrutiny and litigation, and the sector as a whole, which now faces a new round of doubts about data security in third-party ID verification schemes.

Article Topics

data privacy  |  driver's license  |  ID verification  |  identity document  |  IDScan.net