Identity verification company IDScan has confirmed a major cybersecurity breach involving sensitive government-issued identification data, following reports that more than 150 million driver’s-license records appeared in a searchable dark-web database.
IDScan said it received information around September 1 indicating that an unauthorized third party may have accessed or copied customer information stored in accounts on the company’s cloud platform.
The compromised information includes full names and driver’s-license numbers, along with identification numbers from other government-issued documents such as passports.
Cybersecurity journalist Brian Krebs initially uncovered a dark-web service known as Nexus that claimed access to more than 153 million U.S. and Canadian driver’s-license records. The database reportedly also contained photos of identification documents and millions of other identity records.
The scale of the incident is particularly concerning because driver’s licenses can contain highly valuable personal information that may be used for identity theft, account fraud, social-engineering attacks and attempts to bypass identity-verification systems.
IDScan provides identity-document scanning and verification technology to businesses across multiple industries. Its cloud technology can process driver’s licenses, passports and other government-issued documents for customer verification.
The FBI has opened an investigation into the breach after reports of the huge collection of identity documents surfaced online.
IDScan says its investigation remains ongoing, and the company has not publicly confirmed that 153 million unique individuals were affected. The 153-million figure refers to the number of driver’s-license records claimed by the dark-web service and may include duplicate or multiple records belonging to the same person.
The incident highlights the potentially enormous consequences of breaches involving identity-verification companies, which can hold far more sensitive and long-lasting information than passwords or payment-card details.
