The firm that scans your ID at the rental desk confirmed a breach, and your driver's licence may be in it

There is a good chance you have had your ID scanned by a company you have never heard of. When you pick up a hire car, buy something age-restricted or open certain accounts, the business often does not check your licence itself. It passes the document to a specialist verification firm that confirms it is genuine. One of the biggest of those firms has now confirmed a data breach, the potential scale is large, and the FBI has opened an investigation. As ever with a breach of this kind, the honest account has to separate what the company has actually confirmed from what anonymous sellers are claiming. They are not the same thing.

What happened?

On or around 1 September 2026, the identity-verification company IDScan.net received information that certain data may have been accessed without authorisation. It posted a data-security notice dated 4 September, but the page carried a "noindex" tag that kept it out of search results, so it went largely unnoticed until TechCrunch surfaced it on 10 September. That is the point at which the breach was widely reported as confirmed. In the company's own words, "an unauthorized third party may have accessed or copied" customer information stored within accounts on the IDScan.net cloud.

Keep the two stages straight. In early September, reporting by Krebs on Security and others described what "sure looks like" a breach, after a searchable dark-web service appeared offering look-ups of ID records and then went offline. The 10 September news is different: it is IDScan confirming, in its own notice, that an incident occurred.

What is IDScan, and why does it have your licence?

IDScan.net is a Louisiana-based identity-verification company. Its systems scan and validate government-issued IDs, including with infrared and ultraviolet imaging to spot fakes, and it says it processes more than 21 million verifications a month across roughly 20,000 locations. Its customers span car-rental agencies, retailers, financial institutions, hospitality and entertainment venues, and cannabis dispensaries.

That business model is exactly why a breach here matters so much: the company sits quietly behind thousands of everyday ID checks, so its database is a concentrated pool of real, verified identity documents. Journalists underlined this by matching leaked records to places where they had personally shown ID, such as a car-rental counter and a dispensary visit. That traces where a document entered IDScan's pipeline; it does not mean those businesses were themselves breached.

How many people are affected?

This is the number to handle carefully, because two very different figures are circulating.

• What IDScan confirms: its own website states it holds "over 150 million driver's license records." It has not disclosed how many individuals were affected by the breach.
• What the sellers advertised: a dark-web listing claimed 153 million-plus US and Canadian driver's licences, plus millions more ID cards, travel documents and other records, with some outlets summarising it as data tied to more than 170 million people in North America. The listing also claimed close to 400,000 new records were being added a day and that data had been exfiltrated "for over a year."

Every figure in that second bullet is the sellers' own claim, not a confirmed count, and should be read that way. The responsible summary is that IDScan holds more than 150 million licence records and has not yet said how many people the incident touched.

What data was exposed?

Per IDScan's notice, the affected information includes full names, driver's-licence numbers, and numbers from other government-issued identification such as passports. Reporting on the sellers' listing goes further, describing front and back licence images plus infrared and ultraviolet scans and, where available, holder photographs. Treat that richer, image-level detail as a description of the listing rather than IDScan's confirmed field list, because the company's own notice does not enumerate it.

Why is a leaked ID harder to recover from than a stolen password?

Because you cannot reset it the way you reset a password. As Malwarebytes put it, "you can reset a password. You cannot easily replace your face, date of birth, address, or license number, particularly when they're accompanied by high-resolution images of your government-issued ID." Real, verified document data makes fraud look legitimate: it is the raw material for convincing phishing, for talking past account-recovery checks, and for opening new accounts or credit in someone else's name. James E. Lee of the Identity Theft Resource Center told Time the data set "will continue to have massive value to the cybercriminal community." The risk is less a sudden account takeover and more a long tail of heightened exposure.

What can you actually do about it?

None of this is legal advice, and the point is vigilance rather than panic. Sensible steps if you think your ID may be exposed:

• Place a credit freeze with the major bureaus (in the US, Equifax, Experian and TransUnion, where freezes are free), or at least a fraud alert. Canadian residents use the equivalents at Equifax Canada and TransUnion Canada.
• Monitor your credit reports and financial statements for accounts or enquiries you did not start.
• Be sceptical of unsolicited contact that quotes your real ID details to "verify" you. Call institutions back on a number you look up independently, never one provided in the message.
• Use strong, unique passwords and turn on multi-factor authentication on email and financial accounts.
• Take up any free credit monitoring offered, and watch for an official notification from IDScan or from a business you used.
• Understand the limits. Some licensing authorities will reissue a licence number, though this varies and is not guaranteed, and no process can recall a document image that is already out there.

Is the FBI involved, and what is IDScan doing?

Yes on both. Reporting by Krebs on Security places the inquiry with the FBI's New Orleans field office, and an FBI spokesperson told Time the bureau was "looking into the incident" while declining further comment, citing the ongoing investigation. IDScan says it took immediate steps to secure its systems, engaged third-party forensic specialists, is reviewing its data-security practices and is cooperating with federal law enforcement. Several outlets report the company is notifying potentially affected people and offering free credit-monitoring and identity-protection services, though that remediation detail is reported rather than something we can read off the notice directly.

Confirmed vs advertised

Claim	Status
IDScan holds "over 150 million" driver's-licence records	Stated on IDScan's own website
An unauthorised party may have accessed cloud-stored customer data	Confirmed by IDScan (notice dated 4 Sep, surfaced 10 Sep)
Number of people affected	Not disclosed by IDScan
153 million-plus licences, close to 400,000 added daily, stolen "for over a year"; outlets put the total at ~170 million people	Sellers' listing and outlet summary, unconfirmed
High-resolution front/back images and IR/UV scans	Reported from the listing, not enumerated in IDScan's notice
FBI investigating	Confirmed (FBI New Orleans)