A massive data breach at Louisiana-based IDScan.net exposed over 153 million driver’s license scans, with hackers maintaining a live, year-long feed of sensitive identity verification records.

Key Points

• The breach involves more than 153 million driver’s licenses from the United States and Canada, currently being sold on a dark web service called Nexus.
• IDScan.net provides identity and age verification services for major corporations, including Hertz, FedEx, Target, and numerous cannabis dispensaries.
• Hackers were actively siphoning new data in real time, adding approximately 400,000 records to the database on the day the breach was publicly disclosed.
• The FBI’s New Orleans field office has launched an official inquiry into the source of the leaked images.
• Compromised data includes high-profile individuals, such as the U.S. Secretary of Defense, whose license was listed for sale on the platform.

Why it Matters

This incident highlights the inherent security risks associated with centralized identity and age verification systems, which create massive, high-value targets for cybercriminals. The breach demonstrates that even companies claiming strict regulatory compliance can suffer long-term, undetected data exfiltration, putting millions of individuals at risk of permanent identity theft.