More than 153 million driver’s license records were allegedly taken from IDScan, a company that provides identity verification services to other businesses. The data was reportedly offered for sale, which is how the breach became public. Multiple lawsuits have since been filed over the alleged incident. If you have ever uploaded a government ID to verify your age, open an account, or sign up for a gig platform, your data may be in that pool — and you almost certainly never knew IDScan was involved.
What happened
IDScan sells identity verification tools to other companies. When a business needs to confirm who a customer is — by scanning a driver’s license or other government-issued document — IDScan is one of the services that can power that process behind the scenes.
Hackers allegedly broke into IDScan’s systems and accessed records from more than 153 million driver’s licenses. Rather than keeping the data private, the attackers reportedly put it up for sale. That is how the breach came to light.
Several lawsuits have now been filed against IDScan over the alleged incident. Key details — exactly when the breach occurred, how the attackers got in, and which specific data fields were taken — have not been publicly disclosed.
Who is affected
Anyone whose driver’s license was processed through IDScan’s verification system is potentially in the exposed pool. That includes ordinary consumers, but also freelancers, creators, and founders who have signed up for platforms that used IDScan to confirm identity.
This is where things get uncomfortable. Identity verification is often invisible. When you upload your ID during a sign-up flow — for a financial app, a gig platform, or an age-gated service — you see the platform’s name, not the name of every third-party service running underneath it. Most people would have no way of knowing their ID ever touched IDScan’s infrastructure.
The businesses that integrated IDScan into their products are also affected, facing their own legal and reputational exposure. Which specific companies used IDScan, and therefore which end users are caught up in this, has not been disclosed.
What the real risk is
A driver’s license is not just a photo. It carries your full legal name, date of birth, home address, and license number — all in one place. For anyone dealing with data breach driver’s license identity theft concerns, that combination is more dangerous than a leaked password, because you cannot reset your date of birth.
For creators and founders, the risk has an extra dimension. Your real name is already attached to your public work — your website, your social profiles, your bylines. That makes it easier for a bad actor to connect exposed license data directly to your professional identity and do something with it.
The most immediate threats are identity fraud — someone opening credit accounts, signing contracts, or registering businesses in your name — and targeted phishing, where an attacker uses your real home address or license number to make a fake message sound convincing.
There is also an impersonation angle. Enough personal detail in the wrong hands can be used to build a fake persona that mimics you convincingly. For anyone with a recognisable personal brand, that is a specific and serious threat.
Because the data was reportedly offered for sale rather than used once and discarded, it may pass through multiple criminal buyers over time. The risk does not have a clear expiry date.
What to do today
These steps are free, achievable this week, and do not require any technical knowledge.
Freeze your credit
Contact each of the major credit bureaus — Equifax, Experian, and TransUnion in the US; equivalent agencies in your country — and place a credit freeze. A freeze prevents new accounts from being opened in your name without your explicit sign-off. It is free. It does not affect your existing accounts. You can lift it temporarily when you need to apply for credit yourself.
Set up fraud alerts
Alongside a freeze, request a fraud alert on your credit file. This tells lenders to take extra steps to verify identity before extending credit. In many countries you only need to contact one bureau and they are required to notify the others — but confirm how it works in your country.
Trace where your ID has been
Think back over the past few years. Which platforms asked you to upload a government ID? Gig economy apps, crypto exchanges, financial services, and age-gated platforms are the most likely candidates. Those are the services most likely to have routed your data through a verification provider. Make a list. Check each one for any account activity you do not recognise.
Lock down your accounts
Change passwords on any account that holds financial, legal, or business information. Use a unique password for each one — a password manager makes this practical. Enable two-factor authentication (that means a second confirmation step, like a code sent to your phone) on every account that offers it.
Watch your business records
If you run a business or hold domain names, check your business registration records and domain ownership details for any unauthorised changes. Someone with your personal data could attempt to redirect these. Many domain registrars let you enable transfer locks — turn them on.
Treat unexpected contact as suspicious
If you receive any message — email, phone call, or letter — that references specific details from your driver’s license, treat it as a potential phishing attempt regardless of how official it looks. Legitimate organisations do not typically lead with your license number or home address to prove they are real.
Why this keeps happening
The deeper problem is one of control. When you hand your ID to a platform you chose to trust, you are also handing it to every third-party service that platform has quietly plugged in. You did not choose those companies. You probably never heard of them. But your most sensitive personal data now lives in their systems.
This is what makes data breach driver’s license identity theft cases so hard to prevent at the individual level. There is no reliable way, in most online systems, to tie your data to you as an accountable person who retains rights over it. Because that link does not exist, the data flows freely between platforms and vendors — and ownership defaults to whoever is holding it at any given moment. That is usually a company, not you.
The value of aggregated identity data is enormous. The cost of a breach falls almost entirely on the individuals whose data was collected. Until the consequences for poor data security become severe enough to change how companies handle sensitive records, breaches of this kind will remain a predictable feature of the digital economy. That is not an accusation — it is a structural observation about how incentives currently work.
For creators and founders, the lesson is direct: your identity is part of your business infrastructure. It deserves the same protective attention you give your contracts, your accounts, and your intellectual property.
Frequently asked questions
How do I know if my data was part of the IDScan breach?
There is currently no public tool to check. Which companies used IDScan — and therefore which individuals are affected — has not been disclosed. Your best indicator is whether you have used platforms that required you to upload a government ID. Monitor your credit reports and account activity, and consider the protective steps above regardless of certainty.
Does a credit freeze hurt my credit score or affect my business?
A credit freeze does not affect your credit score. It does not close existing accounts or change your credit history. It simply prevents new credit from being opened in your name without your permission. If you need to apply for a loan or a new business account, you can lift the freeze temporarily and reinstate it afterwards. How exactly this works varies by country — check with your local credit bureau.
Can someone steal my personal brand or professional identity using driver’s license data?
In practical terms, yes. A combination of your full legal name, address, date of birth, and license number gives a bad actor enough to open accounts, register businesses, or build a fake persona in your name. For creators with a public profile, that fake persona could be used to mislead your audience, sign fraudulent contracts, or damage your reputation. Monitoring your name across platforms and locking down your business registrations reduces this risk.
Related reading
- ARM Windows Crashes: A Creator’s Data Recovery Plan
- When Software Breaks: What Creators Risk Losing
Originally reported by bleepingcomputer.com. This article summarises that reporting and adds practical guidance.
Scams, fraud, bots and manufactured noise keep spreading because the internet was built with no reliable way to know who anyone actually is. Everyone deserves authenticity and accountability online, and that is the mission we are working on. Subscribe to stay informed as this story develops and to get practical guidance when incidents like this emerge.
This article is general information, not legal advice. Laws differ by country — consult a qualified lawyer about your situation.
