IDScan breach tied to 153 million stolen driver's license scans

IDScan.net, a Louisiana-based identity-verification vendor, confirmed a breach of its cloud platform, BleepingComputer and TechCrunch reported on September 10. Krebs on Security had traced the data behind Nexus, a dark-web service selling more than 153 million U.S. and Canadian driver's license scans, to the company. Per BleepingComputer, the company learned of possible unauthorized access on or around September 1; PCMag reported its September 4 notice cited full names and driver's license or other government-issued identification numbers. The control built to confirm identity became the place identity leaked from.

Some records, including Krebs's own, carried six timestamped image files, among them infrared and ultraviolet scans, per Krebs on Security. The FBI's New Orleans field office opened an investigation on September 1, Krebs reported, and Nexus went offline that evening. TechCrunch reported the database included Defense Secretary Pete Hegseth; the Pentagon said it was aware of the suspected breach, and an FBI spokesperson said the bureau was investigating. PCMag reported court records appear to show more than a dozen U.S. class actions, up from four a week earlier.

Corporate security teams face three problems. License images with infrared and ultraviolet layers, paired with names and license numbers, are a kit for account takeover, SIM-swap pretexting and physical-access impersonation against executives and staff. Organizations whose staff were scanned at someone else's counter never chose or audited the vendor's cloud posture. Detection is the third: the company dates discovery to on or around September 1, the day Krebs reported Nexus had grown by nearly 400,000 records in 24 hours.

• Inventory visitor-management, rental, age-verification and onboarding flows that send ID images to vendors.
• Ask those vendors where scans are stored, for how long, and how intrusions are detected.
• Assume principals' and travelers' identity documents are circulating; tighten account recovery and help-desk verification.
• Watch criminal marketplaces for your people's documents, not only domains and credentials.

STRATUM — Cyber Threat is designed to support the last item on that list; it is not a SIEM replacement. Its dark-web and adversary-forum monitoring is designed to surface signals tied to the organization's people and programs, prioritized by mission impact. Analysts decide what a match means, who is notified and what is reset. STRATUM enables them to act on what they find.

Cl0p's Windchill campaign exploited one flaw across many organizations' own deployments. Here the risk concentrates: scans from many organizations' counters sat in one vendor's cloud, and one intrusion exposed them. Each vendor-routed scan is a copy outside the organization's control; vendor risk reviews should price it in.