Key Takeaways
IDScan, an identity verification vendor used by companies from car-rental firms to dispensaries, confirmed on September 10 that hackers stole driver's license data from its cloud.
The exposed records cover more than 150 million people in the United States and Canada and include full names, driver's license numbers, and other government ID numbers such as passports.
The FBI is investigating, and the breach shows how much personal identity data now sits inside third-party verification vendors most people have never heard of.
IDScan, one of the largest identity verification companies in the United States, confirmed on September 10 that hackers stole driver's license data from its cloud, according to a notice the company posted to its website and reporting by TechCrunch.
The stolen information includes people's full names and driver's license numbers, along with identity numbers from other government-issued documents such as passports. IDScan is based in Louisiana and checks IDs for corporate customers ranging from entertainment venues to cannabis dispensaries, so the exposed records reach across ordinary daily life.
How the breach came to light
The breach first surfaced on September 1, when independent security journalist Brian Krebs reported a dark-web site that let anyone search the driver's license details, including photos, of more than 150 million people in the United States and Canada. Krebs verified the data by finding his own record. The database also held high-profile names, including US Defense Secretary Pete Hegseth.
IDScan said its investigation is ongoing and that "though full access to the information required payment," it was notifying potentially affected people through its website notice. The company notes on its own site that it holds over 150 million driver's license records. The FBI is investigating, and the Pentagon said it is aware of the incident.
Why the data lived in one place
The most notable part of this is where the data lived. Most people never chose IDScan, never heard of it, and cannot delete their record from it. The identity checks that let someone rent a car or enter a venue now pool tens of millions of government IDs inside third-party vendors, and a single breach spills all of them at once.
That concentration of sensitive data is the same problem WYDE has tracked in a federal hacking case that charged Iranian nationals with stealing university and government credentials and in an auto-lending fraud case built on records that were pledged twice. When trust sits in a black box, the failure stays invisible until it is total. Worth watching.
People Also Ask
What is IDScan and what data was stolen?
IDScan is a Louisiana-based identity verification company. It confirmed hackers took full names, driver's license numbers, and other government ID numbers, such as passport numbers, from its cloud.
How many people are affected by the IDScan data breach?
IDScan says it holds more than 150 million driver's license records, and a dark-web database advertised the details of over 150 million people across the United States and Canada.
Is the IDScan breach being investigated?
Yes. The FBI is investigating and the Pentagon said it is aware, after the data surfaced on a dark-web site in early September 2026.
How can people protect themselves after a driver's license breach?
Security experts recommend watching for identity-theft and account-takeover attempts, freezing credit where possible, and staying alert to scams that use stolen name and ID number combinations.
Sources
TechCrunch (Zack Whittaker, September 10, 2026), KrebsOnSecurity (September 1, 2026), and the IDScan data security incident notice.