IDScan Confirms Possible Customer Data Access After 153 Million Driver’s License Scans Offered for Sale
Summary
IDScan said an unauthorized third party may have accessed customer information in its cloud platform. Journalist Brian Krebs linked a Nexus marketplace listing of millions of identity records to IDScan; the FBI has opened an inquiry.
Key points
- IDScan said it became aware of the incident around September 1 and disclosed it on September 4.
- The company said an unauthorized third party may have accessed or copied customer information stored in its cloud platform.
- Potentially affected data may include full names and driver’s license or other government-issued identification numbers; IDScan did not say how many customers were affected.
- Brian Krebs reported that the Nexus marketplace offered access to more than 153 million driver’s license scans and other identity documents, and said he authenticated database samples and linked them to IDScan.
- IDScan said it was notifying potentially affected individuals and offering free credit monitoring and identity protection services.
- The FBI has launched an inquiry into the incident.
Article Details
- Victim Organization
- IDScan
- Victim Domain
- IDScan.net
- Incident Type
- Potential unauthorized access to and copying of customer data stored in IDScan's cloud platform; IDScan confirmed the incident but said the access or copying may have occurred.
- Data Types Exposed
- Full names
- Driver's license numbers
- Other government-issued identification numbers
- Driver's license scans
- Identification card scans
- Travel documents and/or international IDs
- Medical card scans
- Affected Records
- IDScan did not disclose how many customers were affected. Brian Krebs reported that a database offered on Nexus included more than 153 million driver’s license scans, 10 million identification card scans, more than three million travel documents and/or international IDs, and at least 579,000 medical cards.
- Affected Data Size
- Not disclosed by IDScan. The database figures were reported by Brian Krebs and associated with the Nexus listing.
- Operational Impact
- IDScan said it was notifying potentially impacted individuals and providing free credit monitoring and identity protection services. No service disruption was reported in the article.
- Ransom Or Extortion
- Nexus was reportedly marketing access to the data, with full access requiring payment. The article does not report a ransom demand to IDScan.
- Claim Status
- confirmed