IDScan.net Blamed for Mega Leak of 153M US and Canada Driver's Licenses

Identity verification firm IDScan.net was reportedly behind the accidental exposure of over 153 million US and Canada driver's license records, some including photos and even infrared/ultraviolet images, offered on the dark web at $100 each. Researchers call it possibly the worst data breach ever, affecting nearly half the US population; the FBI is investigating. The incident has triggered broad reflection on KYC-style centralized ID collection.

Confirmed

• Security researcher vxunderground disclosed that a firm verifying identities for hotels, car rentals, and alcohol/cannabis purchases exposed 153M+ license records with photos; multiple posts point to IDScan.net.
• Affected clients reportedly include Shell, Hertz, Caesars Entertainment, AMC Theatres, DraftKings, and FedEx.
• Per KrebsOnSecurity (via m4), victims include Defense Secretary Pete Hegseth and journalist Brian Krebs himself.
• Per TechNadu, the FBI is investigating; some scans reportedly contain IR and UV images, and timestamps on files offer clues to the data's source, though the origin is not yet confirmed.

Unconfirmed

• The dark-web database only claims to have stolen the scans; the method of theft and full authenticity await official verification, and no IDScan response has been seen.

Why it matters

• Coin Center's Peter Van Valkenburgh (via m3) called for a sweeping rethink of KYC mandates that force users to submit ID photos with addresses; lawyers echoed the criticism (m4).
• W3C identity standards contributor csuwildcat says open-standard tech he helped develop a decade ago could have prevented this honeypot of 153M licenses and could also solve agent-to-human identity verification.
• Blogger BecauseCulture argues zero-knowledge proofs could verify only what's needed (e.g., age) without surrendering full ID documents.

2026-09-02 ~ 2026-09-03 · 7 related posts

• ID Verification Firm Leaks 153M US & Canadian Driver's Licenses, Sold for $100 — matthew_d_green · 2026-09-02
• 153M licenses for sale online sparks ZKP age-verification debate — BecauseCulture · 2026-09-03
• 153M Driver's License Scans Leaked via IDScan.net Hack, Coin Center Slams KYC — StewartalsopIII · 2026-09-03
• [source] Open Standards Pioneer: 153M-License Honeypot Was Preventable a Decade Ago — csuwildcat · 2026-09-03
• [source] Dark web service claims 153M US & Canadian license scans; FBI probes IDScan.net — TechNadu · 2026-09-03
• Dark-web DB claims 153M+ driver's license scans, including Hegseth's and Krebs's — matthew_d_green · 2026-09-03

1 near-duplicate retellings: rickasaurus