IDScan.net Leaked 153 Million Driver License Scans for 13 Months via Unsecured Feed

The breach originated at IDScan.net, a Louisiana firm contracted by Hertz, FedEx, Target, cannabis dispensaries, and age-verification platforms. An exposed endpoint streamed every scanned ID to an attacker-controlled service selling the images. FBI New Orleans opened an inquiry the day the feed went dark. Affected individuals matched dates of ID submission at multiple unrelated businesses, confirming the verifier as the single point of failure.

KrebsOnSecurity documented the 153 million record count through direct access and victim interviews. IDScan.net's Trust Center page, still live post-breach, listed GDPR, CCPA, and SOC 2 attestations while the live feed operated. The same firm publicly supported state age-verification mandates and KOSA provisions that would expand its market. No evidence of encryption at rest or egress monitoring appears in the available logs.

Prior incidents at Onfido, Jumio, and CLEAR showed identical patterns: central collection of high-resolution IDs without effective segmentation. Each breach scaled with regulatory pressure for verification, not with security investment. IDScan.net's exposure demonstrates that compliance checkboxes do not constrain data flow once collection volume exceeds operational controls.

Regulators face a binary choice: mandate collection and accept systemic leakage, or shift to zero-knowledge proofs and decentralized attestations. Existing contracts with state DMVs and federal contractors will require immediate termination clauses and forensic audits within 90 days.