Have you heard about the possible IDScan data breach? I hadn’t until a stray bit of information appeared in my email: A press release from Canada announcing that the Privacy Commissioner was investigating a data breach at IDScan.net after it appeared that a third party had gained access to the database. At least 153 million American and Canadian driver’s licenses might have been compromised. This announcement was a reminder that, while the pro-China crowd is talking about “AI will destroy the world by 2030,” which has supplanted “climate change will destroy the world by 2030,” data breaches are ongoing and a threat to each of us.
Read more Americans are too easily bought
According to KrebsOnSecurity, IDScan.net is a New Orleans company that sells identity-verification technology to businesses. These businesses include big-name companies in retail, car rental agencies, cell phone companies, clothing companies, marijuana dispensaries, and many other high-profile businesses.
The 30,000-foot view is that this is a cool product because it helps determine whether a driver’s license is more likely than not to be legitimate. Given the traffic in fake licenses for everything from illegal aliens to car rentals to the under-21 crowd trying to buy alcohol to getting a new cell phone, this is a useful service.
The problem is that the system can do what computer systems do so efficiently: scrape, categorize, and save enormous amounts of data. Indeed, IDScan’s own documentation says that its default setting for new accounts is to ‘Collect all,’ while its default retention setting is not to delete the records.
Computers can’t help themselves. When you hand your license over to be scanned, the computer gathers every bit of information on it, and that’s a lot of information about how you look, where you live, etc. IDScan reports that it does more than 21 million identity verifications per month, operating at 20,000 locations worldwide, although the service seems to operate mostly in the U.S. and Canada.
It now appears that a data breach in the IDScan.net server may be behind a user named Nexus who appeared on Exploit, a Russian-language cybercrime forum, offering digital scans of more than 170 million identity documents from people living in North America. More than 153 million U.S. and Canadian driver’s license records may have been compromised, along with (possibly) 10 million identity cards, three million travel documents and international IDs, and at least 579,000 medical cards.
While Nexus doesn’t specifically name IDScan as the source of its stolen data, some detective work tied IDScan to the breach. The timestamps on the stolen records matched activities people could identify with certainty. For example, Krebs and his mother handed their licenses over simultaneously at a Hertz car rental counter, and the timestamps on the Nexus info matched that moment. Others were able to do the same timestamp matching to sites that use IDScan.
Moreover, on September 4, IDScan announced that someone had gained access “and/or copied certain customer information stored within their accounts on the IDScan.net cloud.”
This doesn’t mean that half of America was compromised, since records can be duplicated repeatedly if someone frequently showed the same ID. It’s also unclear whether this was a global breach—all IDScan data—or limited to specific IDScan corporate customers, while others were left untouched. However, the Nexus service was extensive enough that customers could search for specific people by name and purchase their images and data.
Read more Book review: ‘The Final Solution to the Jewish Question: A Love Story for the Living’
Ironically, Brian Krebs learned about this dark web activity because the identity thief used his driver’s license to promote the service. The database reportedly includes government officials, including Pete Hegseth!
We are endlessly warned about hypothetical catastrophes that might someday emerge from artificial intelligence, climate change, or whatever other apocalypse currently commands the headlines. Meanwhile, a very real technology problem is already here: we routinely hand our information over to strangers, naively trusting it will remain secure forever.
Image created using AI.
From our sponsor
What you can actually do after a breach like this
Here is the uncomfortable part: once a scan of your license is circulating, you cannot call it back. No service can. What you can do is make yourself harder to assemble.
A stolen document is only half of an identity theft. The other half is the file that connects it to your current address, your phone number, your relatives, and your employer, and that half is not stolen at all. It is sold, legally, by data brokers and people-search sites to anyone with about $20. That is what turns a record in a dump into a convincing phone call from your “bank.”
Incogni sends legally binding removal requests to those brokers on your behalf, monitors for your information resurfacing, and repeats the process automatically, because they relist you the moment you stop looking. Its Unlimited plan lets you submit custom removal requests for anything the standard sweep misses.
You cannot unbreach the breach. You can shrink what a thief is able to do with it.
Get 55% off Incogni’s Unlimited Plan with code AMERICAN55.
This article was selected by American Thinker’s editorial staff. Incogni had no input into the subject matter or how it was reported.