IDScan confirms breach after hackers offer 153 million driver’s license scans for sale

IDScan, an identity verification firm, confirmed a breach exposing data of approximately 153 million driver’s license scans and additional data including identification cards and medical records. The company announced the breach on September 4th, following reports from independent cybersecurity journalist Brian Krebs, who linked the incident to a dark web marketplace called Nexus, tied to Russia.

Krebs authenticated database samples by searching for his and others’ records offered for sale on Nexus and from there tied the hacked data to IDScan’s systems. The data included full names and driver’s license or other government-issued identification numbers, as well as scans of 10 million identification cards and at least 579,000 medical cards.

IDScan stated that while full access to the information required payment, they are notifying potentially impacted individuals and providing free credit monitoring and identity protection services as a precautionary measure. The company has been hit with several lawsuits in recent days.

Independent cybersecurity journalist Brian Krebs first reported the incident. The FBI has launched an inquiry into the incident.

Identity verification has become controversial, particularly now as lawmakers and lawsuits are pushing social media firms to verify user ages with government ID or other rigorous methods.

Suzanne Smalley is a reporter covering digital privacy, surveillance technologies and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.