News Date: 2026-09-04
Identity verification provider IDScan is facing legal action after allegations emerged that criminals obtained access to an enormous collection of scanned identity documents. The reportedly exposed material includes more than 153 million driver license scans from the United States and Canada, alongside millions of other identity, travel and medical documents.
The scale remains an allegation rather than a confirmed breach count. IDScan had not published a public explanation or responded to questions cited in the original report. It was also unclear whether the information came directly from IDScan systems, a customer environment, an integration partner or another point in the document-processing chain.
Why Scanned IDs Are Especially Dangerous
A password can be changed after an incident. A driver license image cannot be replaced as easily. These documents may contain a photograph, signature, address, birth date, physical characteristics, document number and machine-readable data. Combined with information from previous breaches, such records can support convincing account-recovery fraud, synthetic identity creation and impersonation attempts.
ID scanning technology is used across industries including retail, hospitality, financial services, car rental and regulated product sales. This means an individual may have little awareness that a transaction has created a long-lived digital copy of a government document or that the copy may be processed by an external provider.
Steps for Organizations Using Verification Services
- Determine whether full document images are genuinely required after verification is completed.
- Set short, enforceable retention periods for identity scans and extracted data.
- Encrypt document repositories separately from general customer databases.
- Restrict access through strong authentication, least privilege and detailed audit logging.
- Review contracts to identify who stores the information and who must notify affected people.
- Monitor for unusual bulk searches, exports and administrative activity.
The Bigger Governance Question
In my view, the central issue is not limited to whether one company was breached. The incident illustrates the systemic risk created when identity verification services accumulate documents from numerous unrelated businesses. A compromise at a concentrated processor can potentially affect people who never knowingly established a direct relationship with that provider.
Companies should treat scanned identity documents as highly toxic assets rather than routine transaction records. If an organization cannot clearly explain why an image must be retained, who can access it and when it will be deleted, the safer decision is not to keep it. Data minimization will not prevent every intrusion, but it can dramatically reduce the damage when defenses fail.