IDScan confirms leak of more than 150 million identity documents

IDScan, an identity verification company headquartered in Louisiana (USA), confirmed in a notice on its own website that it suffered a data breach involving the theft of driver's licenses from its systems. According to TechCrunch, the acknowledgment came a week after a report indicated that the company had been breached over the course of a hack that lasted about a year.

The data was extracted from the company's cloud. According to the notice, the stolen information includes full names and driver's license numbers, as well as identification numbers from other government-issued documents, such as passports. IDScan says it holds more than 150 million driver's license records, although it has not yet disclosed how many people were actually affected.

What happened, in order

IDScan said it "received information" around September 1 about an alleged breach, the same day cybersecurity journalist Brian Krebs published the first report on the incident. Krebs said he had been alerted to a dark web site that allowed anyone to look up driver's license data for more than 150 million individuals in the US and Canada, including access to their photos.

The journalist verified the authenticity of the data by examining his own record. The database also contained public figures, including US Secretary of Defense Pete Hegseth, and a security researcher who confirmed his own data for the report. The Pentagon told TechCrunch it was aware of the suspected leak, and an FBI spokesperson said the agency was also investigating the case.

According to IDScan, full access to the stolen dataset required payment, suggesting a financial demand made by the attackers to release the complete cache. The company did not respond to TechCrunch's request for comment on whether a ransom demand was made to prevent the data from being disclosed.

Why this matters for developers building in Brazil

IDScan serves corporate clients ranging from concert venues to cannabis dispensaries, using the service to check and validate their customers' documents. That's exactly the architectural pattern that repeats in Brazil: fintechs, marketplaces, crypto exchanges, betting platforms, and rental platforms outsource the KYC (Know Your Customer) and identity verification step to specialized providers.

The point this incident lays bare is that, by integrating a verification provider, you inherit its risk. A leak like IDScan's isn't just IDScan's problem: the data of users who went through that flow is in the compromised database. For the developer who plugged in the SDK or consumed an identity provider's API, the attack surface grew without a single line of their own code being touched.

In the Brazilian regulatory context, this carries concrete weight. Under the LGPD (Brazil's data protection law), document numbers, full names, and facial images are personal data, and the face used in liveness verification qualifies as biometric data, treated as sensitive data. A leak involving this type of information triggers notification obligations to the ANPD (Brazil's data protection authority) and to the data subjects, and liability can fall on the controller (the company that offers the service to the end user), not just on the operator (the verification provider).

What to review now in your verification flow

If your product relies on a third party for KYC or document verification, it's worth using the IDScan case as a trigger for a practical review. Here are a few points I'd put at the front of the line:

• Map what the provider retains. The central question is: after verification is complete, does the provider keep the document image, the liveness photo, and the numbers? For how long? One of the lessons from this case is that a database of 150 million records only exists because the data stayed stored in the provider's cloud.
• Minimize what's transmitted and what persists. If you can receive just a boolean result ("document valid / face matches") instead of the full payload with numbers and images, that's the more defensible architecture. Storing a driver's license image in your own bucket "just in case" turns you into the next target.
• Demand contractual clarity on incidents. Notification deadlines, the scope of data under custody, and liability in the event of a leak need to be in the contract with the operator, not discovered after the dark web has already indexed the database.
• Have a response plan ready. Who are the affected data subjects within your scope? How do you notify them? IDScan took a week between "we're investigating" and "we've confirmed the theft"; that gap is the worst moment to improvise communication.

What's still open

IDScan's investigation is still ongoing, and the company has not detailed the attack vector, how long the attackers remained inside the environment before detection, or the exact number of people affected among the more than 150 million records it says it holds. It also hasn't been publicly confirmed whether a ransom demand was made.

For Brazilian developers, the lesson doesn't depend on these details: identity providers concentrate one of the most valuable data sets that exist, which makes them permanent targets. Outsourcing verification still makes operational sense, but outsourcing verification never outsources responsibility for your user's data. It's worth following the developments directly in IDScan's own notice and in updates to the original report.