Over 150 Million Driver's Licenses Have Been Leaked

Credit: Yeong-Ung Yang/Newsday via Getty Images

Table of Contents

If you have a driver's license in the U.S or Canada, there's a pretty good chance that your data was recently for sale on the dark web. A massive hack at ID verification company IDScan.net compromised records for more than 150 million drivers, resulting in scans of licenses being made available to bad actors. IDScan.net is a Louisiana-based company that provides identity and age verification services for industries ranging from casinos and cannabis dispensaries to hotels and car rentals.

What happened with the IDScan.net breach?

According to an incident notice on IDScan's website, the company received information "on or around" Sept. 1 that an unauthorized third party was able to gain access to stored customer data, including full names along with driver's license and government-issued ID numbers.

This was around the time that a major breach was reported by cybersecurity journalist Brian Krebs, who received a tip that driver's license information—including digital scans—was available for sale on the dark web via an identity theft service dubbed Nexus. The platform advertised access to more than 153 million driver's licenses, and Krebs and security researcher Zach Edwards verified the data and identified IDScan as the likely source. As TechCrunch reports, the FBI is investigating the breach, and the database has since been taken offline.

What to do if your drivers license has been compromised

A lost or stolen driver's license creates a high risk of identity theft and fraud, as hackers can use it to open financial accounts and take out loans in your name, commit mail fraud, create a fake ID, and even develop a synthetic identity (which combines both real and fake personal data) that could be used to commit a crime. If thieves have access to your physical license or a scan, as in this latest breach, they have a complete set of information, including your birth date and photo, to assume your identity. Fraudsters can also do a lot of damage with just your driver's license number.

If your driver's license information has been compromised in a breach, you should take all the usual steps against identity theft, including pulling your credit reports, monitoring your financial accounts, and setting up fraud alerts. (At this point in the data breach game, your credit should already be frozen unless you are actively applying for a new card or loan, but if you haven't yet, do it immediately.)

Because your driver's license is so valuable to identity thieves, Experian also recommends requesting your driving record, which you can get from your state's department of motor vehicles, and running a background check on yourself. Both can reveal if any fraudulent activities have been carried out in your name—for example, if someone has been pulled over or if there are arrest warrants or criminal charges linked to your identity. You can file a police report for a lost or stolen license and report identity theft if you believe your information is being used fraudulently.

IDScan.net is reportedly alerting individuals affected by this latest breach, and given its scale, you should be on the lookout for a notice. The company is offering credit monitoring and identity protection services to those impacted, and you can call 1-833-516-2980 to enroll.