What is IDScan and how was it compromised?
IDScan is a vendor of identity verification services used by retailers, banks, hotels, and car rental agencies. The company uses scanners to read driver's license data for age verification and customer onboarding. The breach is believed to be a compromise of IDScan's customer data repository, not a state DMV breach. The breach may be linked to a cloud storage misconfiguration, a third-party software vulnerability, or a credential compromise. The FBI investigation is ongoing (KrebsOnSecurity, 2026).
What to do if your driver's license is exposed
- Place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion).
- Consider a credit freeze for maximum protection (free, prevents new account opening).
- Check your credit reports weekly at annualcreditreport.com.
- Watch for phishing emails and calls referencing your personal information.
- Monitor your Explanation of Benefits (EOB) from your health insurer.
- Monitor your bank and credit card statements for unusual activity.
- Consider applying for a new driver's license number if your state allows it (a few states, like Arizona, allow number changes for identity theft victims).
- File a complaint with the FTC at identitytheft.gov if you detect fraud.
- Consider joining the class action lawsuit if you receive notice of eligibility.
What the FBI recommends
The FBI recommends that affected individuals: (1) Be cautious of any unsolicited contact requesting personal information, (2) Monitor credit reports and financial accounts, (3) Consider a credit freeze, (4) Use strong, unique passwords for all online accounts, (5) Enable multi-factor authentication (MFA) on all financial and email accounts, (6) Report suspected identity theft to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov (Federal Bureau of Investigation, 2026).
Class action lawsuit details
A class action lawsuit was filed in the US District Court for the Western District of Texas. The lawsuit alleges: (1) negligence for failure to implement reasonable security measures, (2) breach of contract for failing to protect customer data, (3) violation of state consumer protection laws. The lawsuit seeks: (a) compensatory damages, (b) credit monitoring services for affected individuals, (c) injunctive relief requiring IDScan to improve security, (d) attorney's fees. Affected individuals may be eligible to join the class action. A class certification hearing is expected in early 2027 (Reuters, 2026).
Drivers' license data breach history
Drivers' license data has been breached in several major incidents: (1) Equifax 2017 — driver's license numbers of 147 million Americans were exposed; (2) T-Mobile 2021 — driver's license data of 76.6 million customers; (3) IDScan 2026 — 153 million records. These breaches have made drivers' license numbers a high-value target for identity thieves (Privacy Rights Clearinghouse, 2026).
What is the dark web marketplace for driver's licenses?
Drivers' license data is sold on dark web marketplaces for $20-$100 per record (compared to $5-$15 for credit card numbers). A full identity package (name, SSN, DOB, driver's license, financial data) can sell for $1,000 or more. The IDScan data is being sold in bulk at significantly lower per-record prices due to the volume, making it accessible to a wider range of criminals (Privacy Rights Clearinghouse, 2026).
Resources and next steps
Visit identitytheft.gov for free identity theft recovery resources. Monitor your credit reports at annualcreditreport.com (free weekly). For ongoing investigation updates, monitor KrebsOnSecurity and FBI IC3 at ic3.gov. For the class action lawsuit, consult an attorney or visit the plaintiff's website (when available). For the IDScan-specific data breach, monitor the IDScan website and the Texas Attorney General's office.
Fazlur Rahman
