A person types a name into a website on the dark web and gets back a driver’s license: the name, the license number, and in some cases a photograph. The security journalist Brian Krebs tried it with his own record and found it matched. The database behind that site, he reported, holds information on more than 150 million residents of the United States and Canada.
The company at the center of the leak is IDScan, a Louisiana-based identity-verification firm. This week the company posted a notice on its website confirming that hackers had stolen driver’s-license data from its cloud environment, including names, license numbers and identifying numbers from other government documents such as passports.
Krebs first reported the breach on September 1. When he reached the company that day, it offered only a short statement saying it was investigating. The gap between that terse answer and the full confirmation that followed this week has become part of the story, along with the scale of what was taken.
IDScan is not a household name, but its reach is wide. Its customers range from entertainment venues and bars to cannabis dispensaries, businesses that scan a customer’s identification to verify age or identity. That means the data it holds is not limited to a single industry; it spans the places where people hand over a license for a quick check.
IDScan built its business on a simple service: a customer’s identification is scanned, checked against issuing records or the company’s own database, and the business gets an answer about whether the person is old enough or who they claim to be. That service produces a digital trail of exactly the data a fraudster would want gathered in one place.
The value of the stolen data is what makes the breach serious. A driver’s license number and a photograph can be used to open accounts, commit fraud and defeat the very identity checks IDScan exists to perform. The breach turns a tool built to verify identity into a source of identities for anyone who pays for access.
The database reportedly includes information on Pete Hegseth, the U.S. secretary of defense, according to Krebs. The presence of a cabinet official’s records in the trove has drawn the attention of federal investigators, and both the FBI and the Pentagon are said to be looking into the matter.
The incident follows a pattern that has become familiar in the identity and verification sector. Companies that handle sensitive personal data in bulk have become prime targets, because a single successful intrusion can yield millions of usable records rather than the handful a consumer-facing breach might expose.
The consequences unfold slowly. Unlike a stolen credit card, which can be canceled in minutes, a driver’s license number stays with a person for years, and the states that issue licenses rarely change the numbers unless fraud is proven. The people in this database will be managing the fallout long after the headlines fade.
For IDScan’s customers, the breach raises immediate questions. A venue that relied on the company to verify that a person is who they claim now has to ask whether the same service made its patrons’ data less safe. Trust in the verification process itself is damaged when the verifier is the one that lost the data.
The company has not detailed how the intrusion happened or what protections failed. Those disclosures, when they come, will determine how regulators and customers judge the incident. In the meantime, the notice on the website is an acknowledgment that the worst-case assumptions about the September 1 report were correct.
State and federal officials have grown less patient with breaches of this kind. Companies that hold identity data are increasingly required to disclose quickly and to bear the cost of notification and credit monitoring. The gap between the September 1 report and the company’s confirmation this week is the kind of delay that draws regulatory attention.
Analysts who track the identity-verification industry said the breach could have commercial consequences as well. The market is crowded, and businesses that scan IDs can move to a competitor if they conclude their vendor cannot be trusted with the most sensitive data a customer hands over.
The larger lesson is an uncomfortable one for an industry built on accumulating personal information. Every database of identities is a liability as much as an asset, and the companies that hold the largest ones are now the most attractive targets. IDScan learned that at the cost of 150 million records.
For the people in the database, the immediate task is vigilance. They will be told to watch their credit and their accounts, and to be suspicious of any unexpected use of their information. For IDScan, the task is larger: to explain how it lost the very records it was entrusted to protect, and to persuade its customers and the public that it can be trusted again.
