IDScan Faces Lawsuits Over Alleged Breach Exposing 153 Million Driver's Licenses

What happened

According to BleepingComputer, identity verification company IDScan is facing multiple lawsuits following an alleged breach in which attackers claimed to have stolen and offered for sale more than 153 million driver's licenses. Details of the intrusion method, timeline, and full scope have not been independently confirmed at this stage, and the report reflects allegations made in litigation and by the alleged attackers rather than a confirmed forensic finding.

Why it matters for defenders

IDScan provides identity verification services, meaning the data reportedly at risk — driver's license images and associated personal information — is exactly the kind of high-fidelity PII used to bypass know-your-customer (KYC) and identity-proofing checks elsewhere. A breach of this scale, if confirmed, would be significant not just for the individuals whose licenses were exposed but for any organization that relies on driver's license data as a trust anchor for onboarding, account recovery, or age/identity verification. Stolen license data is commonly reused for synthetic identity fraud, account takeover, and bypassing document-based verification controls.

What defenders should watch for or do now

• Treat driver's license number and image-based verification as a weaker control going forward; consider layering additional signals (device, behavioral, liveness) for identity-proofing workflows that may rely on IDScan or similar vendors.
• Review vendor risk assessments and data-sharing agreements with any identity verification or KYC providers to understand what customer PII they hold and how breach notification would flow to you.
• Monitor for surges in synthetic identity fraud or account-opening fraud that correlate with driver's license data, and watch fraud/dark-web monitoring feeds for chatter referencing this dataset.
• If your organization is an IDScan customer, watch for official breach notifications and be prepared to reassess identity-verification dependencies for affected users.

Developing story

This is based on early reporting and pending litigation; the underlying facts of the alleged breach have not been fully verified and may evolve. For the latest details, see the original report from BleepingComputer.