NEW ORLEANS, September 17 — A Louisiana-based identity verification company has disclosed that an unauthorized third party may have accessed or copied customer information from its accounts around September 1, a breach that a consumer-protection group says could involve driver’s license images on a scale rarely seen in a single incident. IDScan.net, which sells identity verification and fraud prevention technology to businesses that need to check a customer’s ID — to buy alcohol, to rent a car — posted a data security notification on its own website.
The company said the information potentially exposed may include full names and driver’s license or other government-issued identification numbers.
What the company has and hasn’t said
Neither IDScan.net nor its client companies have published specifics about which customers were exposed. That silence leaves an unusually wide blast radius. The company’s technology sits behind the counter at retailers, rental desks and other points of sale, meaning the records it holds are not its own customers’ data in the ordinary sense — they are the scanned identities of people who walked in to prove who they were.
James Lee, president of the Identity Theft Resource Center, told WBAY that the number of people potentially impacted is significant. “We’ve been told that there’s in excess of 150 million images of driver’s licenses, state IDs, and medical dispensary cards,” Lee said.
What makes this one different, he added, is the format of the data. “But what’s really interesting about this breach, and what makes it very risky for people, is these are the full images of driver’s license,” Lee said. A full image is not a number in a database field.
It is the document itself, with the photograph, the address, the date of birth and the security features all legible to anyone who holds the file.
Investigators and regulators weigh in
The FBI confirmed it is looking into the incident. “The FBI can confirm that it is looking into the incident. Due to the ongoing nature of the investigation, we decline to comment further,” the bureau responded to an inquiry by Action 2 News.
Wisconsin’s Department of Agriculture, Trade and Consumer Protection’s Bureau of Consumer Protection said it was not notified of the breach and has not received any related consumer complaints. “We do not have any additional information to provide other than what can be found from IDScan’s website,” DATCP said.
If exposed, the information could lead to identity theft. Lee advised people to take steps to reduce their risk. “Make your information less useful to the identity criminal,” he said.
“Don’t wait to have some sort of notice. Go ahead and freeze your credit because that stops new credit from being issued in your name.” The Wisconsin DMV shared suggestions to protect identity, and noted that people who are victims of a scam may take certain actions.
The breach highlights the risks of sharing driver’s license images with third-party verification services. The story was reported by WBAY in Green Bay, Wisconsin. What to watch next is whether IDScan.net or its clients name the affected accounts, and whether the 150 million figure holds up under the FBI’s review.
Until then, the practical advice from Lee stands on its own: freeze first, ask questions later.
