IDScan experienced a security breach where an unauthorized third party accessed or copied customer information stored within its cloud platform. The compromised data includes customers' full names and government-issued identification numbers, including scans of driver's licenses. The breach was linked to a dark-web marketplace advertising a database containing over 153 million U.S. and Canadian driver's license scans, along with millions of other ID documents. IDScan discovered the breach around September 1, 2026, and has taken steps to secure its systems and is cooperating with federal law enforcement. The company is providing notifications and credit monitoring services to potentially impacted individuals. The investigation is ongoing, and multiple threat actors have claimed to sell the stolen database.

The breach exposed highly sensitive personally identifiable information (PII), including full names and government-issued ID numbers, as well as scans of driver's licenses for over 153 million individuals. This level of exposure poses significant risks of identity theft, fraud, and other malicious activities targeting affected individuals. The breach also damages the trust in IDScan's identity verification services and has led to multiple lawsuits. The availability of this data on dark-web marketplaces increases the likelihood of widespread misuse.

IDScan has taken immediate steps to secure its systems upon discovery of the breach and engaged third-party specialists to investigate. The company is cooperating with federal law enforcement agencies. Affected individuals are being notified and offered free credit monitoring and identity protection services. No specific patch or fix is applicable as this is a breach incident rather than a software vulnerability. Organizations using IDScan services should monitor communications from the vendor and follow any additional guidance provided. Individuals potentially impacted should utilize the offered credit monitoring and remain vigilant for signs of identity theft.