More than 150 million driver’s license records may have been exposed in a massive data breach at identity verification company IDScan.net.
IDScan confirmed that an unauthorized third party may have accessed or copied customer information stored in its cloud, including names, driver’s license numbers and other government-issued identification numbers. The company has not yet disclosed how many people were affected, and its investigation is ongoing.
The breach could put affected consumers at risk of identity theft and fraud, particularly because driver’s license information can be used to help verify your identity.
If you think your information may have been compromised, taking steps now can help reduce your risk of identity theft. Consider freezing your credit and monitoring your accounts and credit reports for suspicious activity. An identity theft protection service can provide additional monitoring and alert you to potential signs of fraud.
Here’s what we know about the IDScan data breach and the steps you can take now.
What happened in the IDScan data breach?
IDScan.net said it learned around Sept. 1 that data stored in its systems may have been accessed without authorization. The identity verification company says it secured its systems and brought in third-party specialists to investigate the incident.
The company’s announcement came after cybersecurity journalist Brian Krebs reported discovering a dark-web website that allowed users to search driver’s license information belonging to more than 150 million people in the United States and Canada. Krebs reported that the database included driver’s license photos and said he confirmed the data’s authenticity by finding his own information.
IDScan provides technology that businesses use to scan and verify driver’s licenses, passports and other forms of identification. Its customers span industries including banking, hospitality, retail, transportation and entertainment. You may not recognize IDScan by name because the company operates behind the scenes. If you’ve submitted a driver’s license or other government-issued ID to a business that uses IDScan for identity verification, your information may have passed through its systems.
IDScan has not said how many people were affected. The company says it’s cooperating with federal law enforcement as it continues to investigate the breach.
What information was exposed?
According to IDScan, the affected data may include:
- Full names
- Driver’s license numbers
- Identification numbers from other government-issued documents
Reporting about the database indicates that driver’s license photos were also accessible, although IDScan has not confirmed in its public notice that photos were among the affected information.
Stolen identification information can potentially be used to commit identity theft or fraud. And unlike a password, which you can change relatively easily after a breach, information like your government-issued identification number can be more difficult to replace.
What should you do after the IDScan data breach?
Even if you haven’t noticed any suspicious activity, taking a few precautions now can help protect your identity and finances.
1. Take advantage of IDScan’s free identity protection
IDScan is offering free credit monitoring and identity protection services to potentially affected consumers. You can call IDScan at 1-833-516-2980 from 8 a.m. to 8 p.m. ET, Monday through Friday, excluding holidays, to ask about the incident and enroll.
Be wary of unsolicited emails, texts or phone calls claiming to be related to the breach. Instead of clicking a link in an unexpected message, use contact information published directly by IDScan.
2. Freeze your credit
Consider freezing your credit with Equifax, Experian and TransUnion. A credit freeze restricts access to your credit reports, making it more difficult for someone to open a new credit account in your name.
Credit freezes are free and don’t affect your credit scores. You’ll need to contact each of the three major credit bureaus separately to freeze your reports.
3. Monitor your credit and identity
Check your credit reports and financial accounts regularly for activity you don’t recognize. IDScan recommends reviewing your credit reports and account statements for suspicious activity or errors.
Identity theft protection services can provide additional monitoring. Depending on the service, you may receive alerts about changes to your credit reports, personal information found on the dark web or attempts to open new accounts in your name. Some plans also provide identity restoration assistance and reimbursement for certain expenses related to identity theft.
4. Contact your state’s motor vehicle agency if necessary
If your driver’s license information has been compromised, contact the agency that issued your license to find out what steps it recommends.
Depending on your state and circumstances, you may be able to report the compromised license or request a replacement. Don’t assume that replacing the physical card will eliminate the risk, though. Ask your state’s agency whether a replacement will also change your driver’s license number.
5. Report identity theft
If you find evidence that someone has used your information to commit fraud, report it to the Federal Trade Commission (FTC) at IdentityTheft.gov.
The FTC can create a personalized recovery plan based on the type of identity theft you’ve experienced. You may also need to contact your financial institutions, credit bureaus or other companies where you find fraudulent accounts or transactions.
Compare identity theft protection services
If you want an extra layer of protection after a data breach, an identity theft protection service can help you keep an eye out for suspicious activity and provide support if your information is misused.
| Provider | Best for | Key feature |
| Aura | Overall protection | Three-bureau credit monitoring with near-real-time alerts for new credit inquiries, plus an in-app Experian credit lock |
| LifeLock | Identity theft recovery | Identity monitoring plus assisted identity restoration if your personal information is used fraudulently |
| IdentityForce | Broad identity monitoring | Monitors all three credit bureaus, the dark web, financial accounts and payday loan applications |
| IdentityIQ | Credit and application monitoring | Monitors credit plus non-credit applications, including attempts to open utility and payday loan accounts using your information |
Bottom line
You don’t have to wait until you see signs of identity theft to take action after a data breach. If you’re concerned your driver’s license information was exposed in the IDScan breach, consider enrolling in identity protection, freezing your credit and monitoring your accounts and credit reports for suspicious activity.
FAQs
How do I know if my information was affected?
IDScan has not disclosed how many people were affected by the breach. The company says it’s reviewing the compromised data to determine whose information was involved and will notify affected individuals as appropriate.
Be cautious if you receive an email, text or phone call claiming your information was exposed. Scammers can take advantage of major data breaches to send phishing messages, so verify that a notification is legitimate before clicking links or providing personal information.
Can someone steal my identity with my driver’s license?
A driver’s license number alone may not be enough to steal your identity, but it can increase your risk when combined with other personal information. Identity thieves may use stolen driver’s license information to impersonate you, open accounts, apply for loans or pass identity verification checks.
Can data removal services help after a breach?
Data removal services such as Incogni can help reduce how much of your personal information is available online by requesting its removal from data brokers and people-search sites. However, they can’t remove information already stolen in the IDScan breach or prevent it from being misused.
Consider data removal an additional privacy measure rather than a replacement for freezing your credit, monitoring your accounts or using identity theft protection.