A company most people have never heard of may hold a scan of your driver’s license — and according to multiple lawsuits now filed against it, that data may have been taken by hackers and put up for sale. Here is what is known about the IDScan data breach involving driver’s license records, and what you can do about it right now.
What happened
IDScan is a business-to-business company. It provides identity verification technology that other businesses — venues, retailers, age-restricted services — use to scan and check customers’ driver’s licenses at the point of entry or sign-up. Most people who had their ID scanned through this system would never have seen the IDScan name at all.
Hackers allegedly broke into IDScan’s systems and then offered to sell the data they had taken. The claim attached to that offer was significant: more than 153 million driver’s license records. Multiple lawsuits have since been filed against the company.
How exactly the breach occurred has not been publicly disclosed. IDScan has not confirmed which specific businesses used its service or which customers are confirmed to be affected.
Who is affected
The short answer: anyone whose driver’s license was ever scanned by a business using IDScan’s verification service could potentially be in this pool.
That is a wide net. Because IDScan worked behind the scenes for many different types of businesses, the affected group likely spans multiple industries and locations. You would not necessarily know which venues or retailers were using IDScan’s technology when they checked your ID — that is simply not information businesses typically share with customers.
Which specific organisations used IDScan has not been disclosed. If you have had your ID scanned at a bar, a venue, a car rental desk, or a similar service in recent years, it is worth treating yourself as potentially affected until more information becomes available.
What the real risk is
A driver’s license is one of the most information-dense documents most people carry. In a single card, it holds your full name, home address, date of birth, and license number. That combination is exactly what fraudsters need to impersonate you.
With those details, someone can attempt to open credit accounts, apply for loans, or pass identity checks in your name — the pattern of crime known as identity theft. The damage can take months or years to untangle.
There is a second risk specific to this situation. Because the data was allegedly offered for sale, it may already be in the hands of multiple parties, not just the original hacker. Criminals who buy stolen personal records often use them to craft convincing phishing messages — emails or texts that reference your real name and address to appear legitimate.
Personal details from old breaches do not expire. Records stolen years ago are still actively used for fraud today.
What to do today
This is the part that matters most. Do not wait for a notification letter — it has not been disclosed whether IDScan plans to contact affected individuals directly.
Pull your credit reports
In many countries you are entitled to free credit reports. In the United States, you can request reports from all three major bureaus — Equifax, Experian, and TransUnion — at AnnualCreditReport.com. Look for accounts you did not open and enquiries you do not recognise. Do this within the next few days.
Place a fraud alert or credit freeze
A fraud alert tells lenders to take extra steps to verify your identity before opening new accounts. A credit freeze goes further — it locks your credit file so no new account can be opened at all, unless you temporarily lift the freeze yourself. A freeze is free in the United States and is widely considered the stronger option. Contact each of the three major bureaus separately to set one up.
Watch for phishing built from your real details
Be alert to emails, texts, or calls that mention your name, address, or date of birth. Fraudsters use real data to make fake messages look credible. If you receive anything claiming to be from IDScan or a related service asking you to click a link or confirm information, do not engage with it directly. Go to the company’s official website yourself instead.
Keep a record
Write down any suspicious activity — dates, what was said, what account was involved. A clear log is valuable if you need to report fraud to a bank, a regulator, or law enforcement later.
Why this keeps happening
Identity verification companies are an especially attractive target. Their entire business is built around collecting the kind of detailed personal records that fraudsters value most. One successful attack on a company like IDScan can expose customers from hundreds of different organisations at once.
But the deeper problem is structural. Online systems have no reliable way to confirm that the person presenting an identity is actually that person in real life. So the whole model ends up being: collect the records, hope they stay secure, and chase the damage afterwards if they do not. Regulations require companies to protect data, but lawsuits filed after a breach do not undo the harm already done to the people whose information was taken.
For ordinary people, the practical consequence is uncomfortable: your personal details may sit in databases belonging to companies you have never directly dealt with. Your own caution online cannot protect data you did not know was being held. Monitoring your own credit and financial accounts is not a perfect solution — but right now, it is the most effective tool available to you.
Frequently asked questions
How do I know if my driver’s license was part of the IDScan breach?
There is currently no public tool to check. Which businesses used IDScan has not been disclosed. If you have had your ID scanned at any venue, retailer, or service in recent years, treat yourself as potentially affected and take the protective steps above.
Can someone use just my driver’s license details to steal my identity?
Yes. A driver’s license contains enough information — name, address, date of birth, and license number — to pass many identity checks and apply for credit or accounts in your name. Combined with other data that may already be available from previous breaches, the risk is real.
What is a credit freeze and does it actually help?
A credit freeze locks your credit file at the major bureaus. When it is in place, lenders cannot access your file to approve a new application — which means a fraudster using your details to apply for credit will typically be blocked. You can lift the freeze temporarily when you need to apply for something yourself. It is free in the United States and is one of the most effective steps you can take after a data breach.
Originally reported by bleepingcomputer.com. This article summarises that reporting and adds practical guidance.
Mafiology tracks the tactics behind these schemes so you can recognise them early. Get our fraud-pattern alerts, plus a free copy of Wes Kussmaul’s Escape the Plantation on how scammers attack you and your family, and what can be done to stop them.
