Identity‑verification specialist IDScan disclosed on September 10, 2026 that a cyber‑attack compromised more than 150 million driver’s license records, making it one of the largest personal‑data breaches of the year. According to the TechCrunch report, threat actors gained unauthorized access to the company’s cloud‑based repository through a misconfigured API endpoint, allowing them to exfiltrate high‑resolution scans of driver’s licenses, associated personal identifiers and biometric data. The breach affects individuals across the United States and several international markets where IDScan provides verification services to banks, ride‑share platforms and government agencies. In response, IDScan has engaged a forensic firm, initiated mandatory password resets, and is offering free credit‑monitoring services to all affected users.
The incident raises serious concerns about the security posture of firms that handle sensitive government‑issued documents. Regulators are likely to scrutinise IDScan’s compliance with the U.S. Federal Trade Commission’s data‑security standards and the European Union’s GDPR, especially given the cross‑border nature of the data. Cyber‑security experts warn that the exposure of driver’s license images could facilitate identity‑theft schemes, synthetic‑identity fraud, and even deep‑fake attacks that leverage biometric data. The breach also underscores the growing risk surface associated with API‑first architectures, where a single misconfiguration can open a backdoor to vast data stores. As companies accelerate digital onboarding, the IDScan episode serves as a cautionary tale, prompting a reevaluation of encryption practices, access controls, and third‑party risk assessments across the identity‑verification ecosystem.
This story was written by a language model from reporting by TechCrunch. Check the original before quoting it.