IDScan Breach Exposes 153M US and Canadian Driver's Licenses

Identity verification firm IDScan was reported to have accidentally exposed more than 153 million driver's license records from the US and Canada, listed on the dark web at $100 apiece. Security researchers have called it potentially one of the worst data breaches in history, with victims covering nearly half the US population.

Confirmed

• Security researcher vxunderground disclosed that a company doing identity verification for offline scenarios such as hotels, car rentals, and tobacco/alcohol/cannabis purchases had exposed over 153 million US and Canada driver's license records; the leaked data includes not just license information but also photos, and multiple reposts point to the company being IDScan.net.
• Affected clients include Shell, Hertz, Caesars Entertainment, AMC Theatres, DraftKings, FedEx, and others.
• m3 said victims include Pete Hegseth and security journalist Brian Krebs, and that a dark web database claims to have stolen these driver's license scans.

Not Yet Confirmed

• m3 described the source as "a dark web database claims the theft"; the exact method of theft and the authenticity of all the data still await official verification. All posts are secondhand accounts or commentary, and no official response from IDScan has been seen.

Why It Matters

• Peter Van Valkenburgh of Coin Center (as relayed by m3) called for a thorough rethink of KYC regimes: forcing users to submit photos of ID documents with home addresses has repeatedly led to databases being hacked and flowing onto the dark web.
• csuwildcat, a W3C identity standards contributor, said the open-standard technology he helped develop a decade ago could have prevented these 153 million license records from becoming a honeypot, and could also solve identity verification between agents and humans.
• Blogger BecauseCulture argued that zero-knowledge proofs (ZKP) could verify only the necessary information (such as age) without handing over a full ID document, technically eliminating the risk of such centralized breaches.

2026-09-02 ~ 2026-09-03 · 5 related posts

• ID Verification Firm Leaks 153M US & Canadian Driver's Licenses, Sold for $100 — matthew_d_green · 2026-09-02
• 153M licenses for sale online sparks ZKP age-verification debate — BecauseCulture · 2026-09-03
• 153M Driver's License Scans Leaked via IDScan.net Hack, Coin Center Slams KYC — StewartalsopIII · 2026-09-03
• Open Standards Pioneer: 153M-License Honeypot Was Preventable a Decade Ago — csuwildcat · 2026-09-03

1 near-duplicate retellings: rickasaurus