ID verification giant IDScan confirms data breach with more than 150 million driver’s licenses stolen

ID verification work IDScan has confirmed that a information breach progressive the theft of driver’s licenses from its systems, a week aft a study said the individuality papers checker had been breached during a year-long hack.

The institution said successful a website notice that hackers stole the driver’s licenses from the company’s cloud; the stolen accusation includes people’s afloat names and driver’s licence numbers, on with individuality numbers from different government-issued documents, specified arsenic passports.

The Louisiana-based steadfast is utilized by firm customers from amusement venues to cannabis dispensaries to cheque and verify the individuality documents of their customers. The announcement is the company’s archetypal acknowledgement that it had been hacked. The institution said past week that it was investigating an incident, but had not yet confirmed an intrusion.

IDScan said successful its announcement that it “received information” connected oregon astir September 1 astir a assertion of a hack, connected the aforesaid time that autarkic cybersecurity writer Brian Krebs first reported a information breach astatine IDScan. 

Krebs reported that helium was alerted to a website connected the acheronian web that allowed anyone to hunt the driver’s licence accusation of implicit 150 cardinal radical surviving successful the United States and Canada, including accessing their photos. Krebs verified the authenticity of the information by examining his ain record. The database besides contained high-profile individuals, including the U.S. Secretary of Defense Pete Hegseth, and a information researcher who besides verified his information for Krebs’ report.

The Pentagon told TechCrunch last week that it was alert of the suspected breach, and a spokesperson for the FBI said it was besides investigating the incident.

IDScan said connected its website its probe was ongoing. The company’s connection said that, “though afloat entree to the accusation required payment” — apt referring to a request for wealth made by the hackers to entree the afloat cache of stolen information — the institution was providing announcement connected its website to notify perchance affected individuals. IDScan has not said however galore individuals are affected but notes connected its website that it holds implicit 150 cardinal driver’s licence records.

IDScan did not respond to TechCrunch’s petition for remark astir the incident, specified arsenic whether the hackers contacted the institution with a ransom request not to merchandise the data.