Anyone who has handed a driver's license across the counter at a car rental desk, a dispensary or a gun shop in the United States may have had it scanned by software from IDScan. The Louisiana company has confirmed that someone got into the cloud platform where its business customers keep that data, after criminals began advertising what they said were more than 153 million license scans.
The confirmation came in a notice dated September 4. IDScan says it learned on or around September 1 that data may have been accessed without authorization, and that somebody outside the company may have looked at or taken copies of what customers keep in their accounts on its cloud service. It describes the affected information as full names together with driver's license numbers or the numbers of other government issued identity documents.
The notice was not easy to find. The page carried an instruction telling search engines not to index it, so it did not turn up in searches and went largely unnoticed until this week.
What the sellers claim
The company's wording is far narrower than what is being offered for sale. At the start of the month a criminal identity theft service was found advertising access to a database of more than 153 million scanned driver's licenses from the United States and Canada, along with about 10 million other identity cards, 3 million travel documents and 579,000 medical cards. Samples from the collection were checked against real people, with their consent, and the trail led back to IDScan.
Those totals come from the sellers and have not been confirmed by the company. IDScan's notice mentions neither document scans nor any number of people affected. It does make one remark that reads like reassurance: full access to the information, it says, required payment. The company adds that it is notifying people who may be affected out of caution and is offering them free credit monitoring and identity protection.
The service that first advertised the data went offline after it attracted attention. That does not mean the data is gone. Whoever ran it presumably still has the files, and others have since claimed to be selling the whole collection.
Why a scan is worse than a number
IDScan makes hardware and software that reads a government identity document, checks that it is genuine and pulls the details out of it. Businesses use it wherever an ID has to be checked: car rental firms, retailers, banks, hotels, cannabis dispensaries and gun shops. Most people whose licenses passed through it have never heard of the company and had no say in whether their document was stored.
If the sellers' description is accurate, the difference between the notice and the reality matters a great deal. A license number can be used for some kinds of fraud. A clear image of the front of a license can be used for many more, because so many online services accept exactly that as proof of identity when opening an account or recovering one.
The FBI has said it is investigating, and IDScan says it is cooperating with federal law enforcement and has brought in outside specialists. Several lawsuits have already been filed against the company in Louisiana, and law firms are looking for plaintiffs for class actions.
People who believe their ID was scanned by a business using IDScan have few options beyond the usual ones. A credit freeze costs nothing in the United States and blocks most attempts to open new credit in someone's name. It will not stop a fraudster who presents a copied license to a service that asks for nothing else.
