An unidentified identity verification provider has suffered a massive data breach, exposing over 153 million driver’s license scans and millions of other sensitive documents on the dark web.

Key Points

• The stolen dataset includes 153 million U.S. and Canadian driver's license scans, 10 million ID cards, and 579,000 medical cards.
• Data is currently being advertised for sale by an anonymous user on the Russian-language cybercrime forum Exploit.
• The FBI has launched an investigation into the source of the leaked images and the scope of the security failure.
• Evidence suggests the provider may be idscan.net, as the leaked files contain records from clients like Hertz and the dispensary chain Planet13.
• Preliminary analysis confirms the scale of the breach, with millions of records already verified through the seller's search interface.

Why it Matters

This breach highlights significant vulnerabilities in the third-party identity verification services used by major retailers and rental agencies to handle sensitive consumer data. The incident underscores the growing risks associated with centralized compliance services and the potential for widespread identity theft when these providers fail to secure their databases.