BATON ROUGE, September 10 — IDScan, the Louisiana-based identity verification firm whose software sits between a customer and a bar, a dispensary or an entertainment venue, has confirmed that hackers stole driver’s licences from its cloud. The company’s website notice is its first acknowledgement that it was breached at all, coming a week after it said only that it was investigating an incident. The stolen material is not incidental.
Full names and driver’s licence numbers are in the cache, along with identity numbers drawn from other government-issued documents, passports among them. That is the technical reality of what an identity checker holds: the exact fields a fraudster needs to impersonate someone, stored in the same place as the photographs that make a forged document pass a human glance.
A week of silence, then a notice
IDScan said it received information on or around September 1 about a claim of a hack. That was the same day independent cybersecurity journalist Brian Krebs first reported a breach at the company. Krebs wrote that he had been alerted to a dark web site allowing anyone to search the driver’s licence information of more than 150 million people living in the United States and Canada, photos included.
He verified the authenticity of the data by examining his own record. The database also held high-profile individuals, among them U.S. Secretary of Defense Pete Hegseth, and a security researcher who likewise verified his own data for the report.
The Pentagon told TechCrunch last week it was aware of the suspected breach. A spokesperson for the FBI said the bureau was also investigating. IDScan has not said how many individuals are affected.
Its own website notes that it holds over 150 million driver’s licence records — the same order of magnitude Krebs described, which is the detail that matters when you are trying to work out whether the whole estate went or just a slice of it.
What the company has and has not said
In its notice, IDScan said its investigation is ongoing. It also said that though full access to the information required payment — language that points to a demand from whoever holds the cache — it was posting the notice to alert potentially affected individuals. The company did not respond to TechCrunch’s request for comment, including on whether the hackers made a ransom demand not to release the data.
Under the hood, this is the structural problem with identity verification as a business. A firm like IDScan is hired precisely because it can be trusted with the documents its corporate customers are not equipped to check themselves, from entertainment venues to cannabis dispensaries.
The trust is the product. It also means a single cloud repository becomes a single point of failure for a population the size of a large country. The breach was reported by TechCrunch security editor Zack Whittaker on September 10 at 6:21 AM PDT.
What to watch next is the scope. IDScan has the record count on its own website and has chosen not to publish an affected figure; Krebs has a dark web search index and a verified sample.
Until the company puts a number on it, the gap between those two positions is where everyone affected currently lives.
