Observed Signal · Sep 10, 2026 · Security Incident · Source: techcrunch · Impact: 3/5 · Sentiment: Negative
IDScan confirms data breach of 150 million driver's licenses
Identity verification service IDScan has confirmed a data breach involving the theft of over 150 million driver's license records from its cloud systems. The stolen data includes full names, driver's license numbers, and other government ID numbers such as passports. The breach, which occurred over a year-long hack, was first reported by cybersecurity journalist Brian Krebs. IDScan, based in Louisiana, serves corporate clients including entertainment venues and cannabis dispensaries. The company acknowledged the incident on September 1 after receiving information about a claim of a hack, and its investigation is ongoing. The FBI and Pentagon are reportedly investigating. The stolen database is accessible on the dark web, with searchable records including photos.
Data breach at a major identity verification provider impacts the AdTech ecosystem due to reliance on identity data, potentially affecting trust and regulatory scrutiny.
Track Real-Time Privacy Signals & Market Shifts
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- IDScan confirmed a data breach involving the theft of over 150 million driver's license records.
- The stolen data includes full names, driver's license numbers, and other government-issued identity document numbers.
- The breach was first reported by cybersecurity journalist Brian Krebs on September 1, 2026.
- IDScan holds over 150 million driver's license records, and the stolen data is accessible on the dark web.
- The FBI and Pentagon are investigating the incident.
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Hackers suspected of breaching ID verification service IDScan
Independent security journalist Brian Krebs reported that a dark web identity search site called Nexus is advertising access to more than 150 million driver's licenses and passports from the US and Canada, apparently stolen from a major identity verification company. Krebs identified the likely source as IDScan, a Louisiana-based ID verification service used by major tech and consumer brands. The site claimed to add about 500,000 new documents daily, suggesting near real-time access to the company's systems. Krebs confirmed his own driver's license was in the database, and Defense Secretary Pete Hegseth's photo was also listed. IDScan's COO said the company is investigating, and the FBI's New Orleans field office is probing the breach. Nexus went offline after the report was published.
ShinyHunters leaks Florida driver data after ransom unpaid
The ShinyHunters hacking group has published hundreds of thousands of files from Florida's vehicle and driver database (DAVID), which was breached earlier in September. The group claims the leak occurred because the state agency, FLHSMV, did not pay a ransom or cooperate. The stolen data includes certificates of vehicle ownership, vehicle identification numbers, and some Social Security numbers and government-issued documents, but not driver's licenses. FLHSMV confirmed the breach, attributing it to compromised police officer credentials. The event follows a separate major breach at identity verification firm IDScan, which resulted in over 150 million driver's license images being stolen. This incident highlights ongoing vulnerabilities in government data systems and the increasing threat of cybercriminal groups targeting sensitive citizen data, with potential implications for identity fraud and advertising data security.
Hotel check-in system exposed over one million IDs
A Japan-based hotel check-in system called Tabiq, maintained by startup Reqrea, left more than one million passports, driver’s licenses and selfie verification photos publicly accessible after a cloud storage misconfiguration. Independent researcher Anurag Sen discovered the exposed files in an Amazon-hosted storage bucket named "tabiq" and alerted TechCrunch; Reqrea secured the bucket after being notified and engaged external counsel while JPCERT was also contacted. The bucket contained records dating from early 2020 through May 2026 and was indexed by GrayHatWarfare. Reqrea says it is investigating the scope of the exposure and plans to notify affected individuals. The incident highlights recurring risks from cloud misconfigurations in identity-verification and KYC workflows.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.