By Alex Wolfram
The IDScan breach is not another leak of usernames and passwords. It involves scans of real driver's licenses, the same ones your staff check at a bar entrance, a hotel front desk, a dispensary counter, or a rental car lot. If your business scans IDs, or if your employees have ever had their license scanned somewhere, this one deserves your attention.
Below we break down what happened, why stolen ID scans are more dangerous than stolen passwords, and the practical steps your business should take this week.
What happened in the IDScan breach
In early September, a dark web marketplace called Nexus began advertising scans of the front and back of more than 153 million driver's licenses, plus other ID cards, travel documents, and medical cards from people in the U.S. and Canada. The sellers claimed the data came from IDScan.net, a Louisiana-based company whose software verifies IDs for businesses across North America.
IDScan later confirmed that an unauthorized party may have accessed and copied certain customer information, including full names and driver's license or other government ID numbers. According to reporting from eSecurity Planet, a breach filing in Texas put the number of affected people at about 13 million. The much larger 153 million figure is what the criminals claimed and has not been confirmed. The marketplace went offline after the story broke, and the FBI opened an inquiry.
Who uses ID scanning services like this
ID verification software is everywhere, and most people never think about it. It is common at:
- Bars, nightclubs, and casinos checking age at the door
- Hotels and short-term rentals verifying guests
- Cannabis dispensaries, which must verify age on every visit
- Car rental counters and shipping centers
- Banks, apps, and online services that ask for a photo of your license to open an account
In Las Vegas and Phoenix, that list covers a big share of local hospitality, entertainment, and retail businesses.
Why stolen ID scans are worse than stolen passwords
When a password leaks, you change it and move on. You cannot do that with your face, your date of birth, your home address, or your license number. Those details stay attached to you for years.
Scans help criminals pass identity checks
Many online services now verify identity by asking for a photo of the front and back of a driver's license, sometimes with a selfie. A clean, high-quality scan of a real license is exactly what a fraudster needs to get through that check. Pair it with AI image tools and the scan can be edited to match a new photo.
Scans fuel targeted scams
A full name, address, and birth date make phishing emails and scam texts far more convincing. A message that knows where you live feels legitimate. We covered how criminals use personal details to impersonate people you know in our recent post on AI impersonation text scams, and leaked ID data makes that kind of attack easier.
Scans enable new accounts in your name
With enough real information, criminals can try to open credit cards, loans, phone lines, or payment accounts in someone else's name. Victims often find out months later when a collection notice arrives.
What to do if your driver's license is stolen or exposed
Whether your license was in the IDScan breach or simply lost, the steps are the same. Share these with your employees, since many of them have had their IDs scanned somewhere.
- Freeze your credit at all three major bureaus: Equifax, Experian, and TransUnion. A freeze is free and stops most new accounts from being opened in your name. You can lift it temporarily when you apply for credit yourself.
- Accept any monitoring offered in a breach notice letter, and keep the letter for your records.
- Review your credit reports for accounts or inquiries you do not recognize.
- Contact your state DMV if you see signs of misuse, and ask what options exist for a replacement or a fraud flag.
- Report identity theft at IdentityTheft.gov if someone has used your information. It creates a recovery plan and the official report you will need.
- Watch for phishing that mentions the breach. Scammers love to send fake breach notices and fake verification requests right after a big story.
- Turn on multi-factor authentication for email, banking, and payment apps so stolen details alone are not enough to get in.
What businesses that scan IDs should do now
If your business uses any ID scanning product, from IDScan or anyone else, this breach is a reminder that the scanner is only half the system. The other half is the vendor's cloud, and that is where this data was taken.
Find out what your scanner stores
Many businesses assume a scanner just checks an ID and forgets it. Often it does not. Ask your vendor, or have your IT provider check, for the answers to these questions:
- Does the system store the full image of the ID, or only the fields it needs?
- Where is the data stored, on the device, on your network, or in the vendor's cloud?
- How long is it kept, and can you shorten that?
- Is the data encrypted when stored and when sent?
- Who at the vendor can access it?
- How and when will they notify you of a breach?
Collect only what you need
If you scan IDs to confirm age, you may only need a yes or no answer, not a stored copy of the license. Turn off image storage and extra data fields wherever your system allows it. Data you never keep is data that cannot be stolen from you or your vendor.
Check whether you were affected
If you are an IDScan customer, contact them directly and ask whether your locations or your customers' data were involved. Document the conversation. Depending on your state and industry, you may have your own notification duties to customers, so talk to your legal advisor early.
Lock down the devices
ID scanners, tablets, and point-of-sale stations are computers on your network. Keep them updated, change default passwords, and separate them from your office and guest Wi-Fi so a problem in one place cannot spread. This is a core part of strong IT security for any business that handles customer data.
Train your front-line staff
Your door staff and front desk team are the most likely to get a fake call or email pretending to be from your ID vendor, asking them to reinstall software, share a login, or export records. Make it a rule that any vendor request like that gets verified with a manager first.
Vendor risk is your risk
Small businesses rarely get breached because someone attacked them directly. More often, a trusted vendor gets hit and the damage flows downstream. The IDScan breach is a clear example. The businesses using the scanners did nothing wrong, yet their customers' data ended up for sale.
That is why vendor reviews belong on every business's security checklist. Keep a simple list of every outside service that touches customer or employee data, what it stores, and who your contact is. Review it at least once a year and any time a vendor makes the news.
Questions to ask before you sign with any vendor
Before adding a new tool that handles personal data, ask a few plain questions. Can you delete our data on request? Do you keep data longer than you need to? Have you had a security review by an outside firm? Will you tell us within a set time if something goes wrong? A vendor that cannot answer clearly is telling you something important. Your IT provider can help you compare answers and spot gaps before you commit.
Quick checklist for this week
- List every system in your business that scans or stores IDs.
- Ask each vendor what it stores, where, and for how long.
- Turn off image retention where you do not need it.
- Update scanners and separate them from guest Wi-Fi.
- Brief staff on fake vendor calls and emails.
- Share the personal protection steps above with your team.
- Encourage employees to freeze their credit.
Get help reviewing your ID and vendor security
Breaches like this one will keep happening, and the businesses that weather them best know exactly what data they hold and who holds it for them. MBPS helps small and mid-sized businesses map their vendors, lock down devices, and train staff as part of our managed IT services.
Not sure what your ID scanners or other vendors are storing? Contact MBPS for a free security assessment, or call us at (888) 656-MBPS.