IDScan Breach Reportedly Exposes 153 Million Identity Document Scans
Summary
A hacker is reportedly selling 153 million identity-document scans allegedly stolen from IDScan. KrebsOnSecurity verified records in the cache, while IDScan says it secured potentially affected systems and is cooperating with law enforcement.
Key points
- The database allegedly contains 153 million driver’s license scans, plus ID cards, passports, and medical cards, largely belonging to people in the United States and Canada.
- KrebsOnSecurity reportedly verified records by matching a scan and its timestamp to a recent IDScan authentication.
- The seller, using the alias NEXUS, claims to have extracted data over several years; observers reportedly saw 400,000 records added in one day.
- Exposed documents may include names, birth dates, addresses, document numbers, photos, and signatures, creating risks of identity theft, fraud, and KYC bypass.
- IDScan says it secured potentially affected systems, preserved logs, hired an independent forensics firm, and is cooperating with law enforcement.
- The FBI’s New Orleans division has reportedly opened an investigation.
Article Details
- Victim Organization
- IDScan
- Incident Type
- Reported data breach involving the alleged extraction and sale of identity-document scans
- Data Types Exposed
- Scanned driver's licenses
- Scanned ID cards
- Scanned passports
- Scanned medical cards
- Names
- Dates of birth
- Residential addresses
- Document numbers
- Photographs
- Signatures
- Affected Records
- A hacker identified as NEXUS claimed the database contained 153 million driver's license records, over 10 million ID card scans, over 3 million passport scans, and 579,000 medical card scans. The article estimates the breach may affect roughly 75 million unique individuals.
- Affected Data Size
- Estimated by the article to exceed 30 TB; the stated estimates range from over 30 TB to 146 TB depending on image size and compression.
- Operational Impact
- IDScan reportedly secured potentially affected systems, preserved system logs, engaged an independent forensics firm, and cooperated with law enforcement. The article reports that the New Orleans division of the FBI opened a formal probe.
- Ransom Or Extortion
- NEXUS was reportedly selling the database on the EXPLOIT cybercrime forum. No ransom demand is reported.
- Claim Status
- claimed