The Louisiana-based firm is used by corporate customers from entertainment venues to cannabis dispensaries to check and verify the identity documents of their customers. The notice is the company’s first acknowledgement that it had been hacked. The company said last week that it was investigating an incident, but had not yet confirmed an intrusion.
IDScan said in its notice that it “received information” on or around September 1 about a claim of a hack, on the same day that independent cybersecurity journalist Brian Krebs a data breach at IDScan.
Krebs reported that he was alerted to a website on the dark web that allowed anyone to search the driver’s license information of over 150 million people living in the United States and Canada, including accessing their photos. Krebs verified the authenticity of the data by examining his own record. The database also contained high-profile individuals, including the U.S. Secretary of Defense Pete Hegseth, and a security researcher who also verified his data for Krebs’ report.
The Pentagon told TechCrunch that it was aware of the suspected breach, and a spokesperson for the FBI said it was also investigating the incident.
IDScan said on its website its investigation was ongoing. The company’s statement said that, “though full access to the information required payment” — likely referring to a demand for money made by the hackers to access the full cache of stolen data — the company was providing notice on its website to notify potentially affected individuals. IDScan has not said how many individuals are affected but that it holds over 150 million driver’s license records.
IDScan did not respond to TechCrunch’s request for comment about the incident, such as whether the hackers contacted the company with a ransom demand not to release the data.
When you purchase through links in our articles, . This doesn’t affect our editorial independence.