US-based company IDScan has confirmed a data breach that exposed driver's licenses and other ID data for over 150 million people across the US and Canada.
The confirmation follows a week of reporting that the company had suffered a year-long intrusion and marks the first time IDScan has publicly acknowledged the incident.
Scale and nature of the breach
According to a notice published on IDScan's website, attackers accessed the company's cloud infrastructure and extracted data, including full names, driver's licence numbers, and identity numbers from other government-issued documents such as passports. IDScan has not disclosed the exact number of individuals affected, though the company's own materials state that it holds records for more than 150 million driver's licences.
The identity verification service states it first received information about the claimed breach on or around 1 September 2026, the same day cybersecurity journalist Brian Krebs reported that a dark web listing offered searchable access to driver's licence data. Krebs verified the authenticity of the dataset by checking his own record and noted that the exposed information included information belonging to high-profile individuals.
Company response and ongoing investigation
The company's notice stated that full access to the stolen data required payment, language that appears to reference a ransom demand made by the attackers, though it is not confirmed whether it received or responded to such a demand. IDScan said its investigation into the incident remains ongoing and that it is providing notice to potentially affected individuals through its website.
IDScan serves corporate customers across sectors, including entertainment venues and cannabis dispensaries, which use the platform to verify customers' identity documents at the point of service. Therefore, the breach raises questions about downstream exposure for businesses that rely on IDScan's verification infrastructure, as well as for the individuals whose documents were checked through the platform.
Regulatory and industry implications
The incident has drawn attention from US federal authorities. Allegedly, a Pentagon official said the department was aware of the suspected breach, and the FBI confirmed it was investigating the matter. The involvement of federal agencies reflects the sensitivity of the data category involved, as driver's licence numbers and passport identifiers are commonly used to authenticate identity across financial services, government platforms, and other regulated sectors.
For the identity verification industry, the breach highlights the concentration risk created when large volumes of government-issued identification data are aggregated by a small number of third-party verification providers. Such incidents typically prompt renewed scrutiny of data retention practices, encryption standards, and breach notification obligations among identity verification vendors operating in regulated markets.
IDScan is not the only company facing breach issues at the moment. Revolut also admitted that sensitive client information had been divulged to a third party, after fraudulent requests were sent from an apparently legitimate government agency email domain.
