IDScan Data Breach: Is Your Driver’s Licence Now in the Hands of Cybercriminals?

Think back to the last time you handed over your driver’s licence. Perhaps it was at a car rental desk, a hotel check-in, a bank branch, or even a local bar or dispensary. You likely assumed the employee was simply verifying your age or identity and that the digital scan would vanish into a secure system. Unfortunately, for millions of people, that wasn’t the case.

Recent revelations have sent shockwaves through the security community. Security researchers have discovered that over 153 million driver’s licence scans from the U.S. and Canada have been leaked and are now circulating on a Russian-language crime forum known as Nexus.

The IDScan Leak: What Exactly Happened?

The trail of this massive data breach leads back to idscan (.net), a New Orleans-based company that provides ID-scanning software to a vast array of businesses, including casinos, gun shops, and thousands of cannabis dispensaries. According to reports by security journalist Brian Krebs, the Nexus forum advertised a searchable database containing not only the scans but also infrared and ultraviolet images of IDs, complete with timestamps.

While IDScan eventually acknowledged that an unauthorized party may have accessed customer information in their cloud, the scale of the disaster is staggering. Unlike a credit card breach—where you can simply call your bank and request a new number—your driver’s licence number is permanent. Most jurisdictions will not issue a new licence number unless you can provide a police report proving documented fraud.

Why This Breach is More Dangerous Than You Think

A stolen scan of your ID is a goldmine for identity thieves. With your full name, birth date, and a high-resolution image of your licence, criminals can:

n
• Perform facial-recognition matching to bypass security protocols.
• Open fraudulent bank accounts or apply for loans.
• Create fake identities to commit further crimes.
• File fraudulent tax returns to steal your refunds.

7 Immediate Steps to Protect Your Identity

If you have had your licence scanned in the last few years, you should assume your data may be compromised. Here is a professional checklist to harden your defenses immediately:

1. Freeze Your Credit Reports

A credit freeze is the most effective way to prevent new accounts from being opened in your name. In Canada, you should contact the two primary credit bureaus: Equifax Canada and TransUnion Canada. This blocks lenders from accessing your credit file without your explicit permission.

2. Secure Your Banking and Utility Access

Identity thieves often target checking accounts and utility services. Consider freezing your profiles with services like ChexSystems or the National Consumer Telecom and Utilities Exchange to prevent fraudulent account openings.

3. Protect Your Tax Identity

Stolen IDs are frequently used to file fake tax returns. Depending on your region, look into getting an Identity Protection PIN (IP PIN) or alerting the Canada Revenue Agency (CRA) if you suspect your Social Insurance Number (SIN) or identity is at risk.

4. Utilize IDScan’s Monitoring Services

IDScan is offering free credit monitoring and identity protection to those affected. While not a complete cure, it provides an extra layer of surveillance on your personal data.

5. Monitor Your Driving Record

Request a copy of your official driving record from your provincial or state motor vehicle agency. Look for tickets or infractions you didn’t commit, which could indicate someone is using your identity on the road.

6. Conduct Weekly Credit Checks

Don’t wait for a yearly report. Set a weekly reminder to check your credit reports for any unfamiliar addresses or accounts.

7. Digital Mail Monitoring

Sign up for digital mail notification services. If a thief attempts to redirect your mail or if a new credit card you didn’t order arrives, you will know instantly.

How to Prevent Future Scans from Becoming Risks

The reality is that in many regions, there are very few laws preventing businesses from storing your ID scans indefinitely. To protect yourself moving forward, start asking this simple question the next time someone reaches for a scanner:

“Do you need to scan my licence, or can you just look at it to verify my identity?”

Many establishments will agree to a visual check. For those that insist on scanning, ask how long the data is kept and how it is secured. You cannot “un-breach” a database, but you can make your personal information far less useful to criminals by being proactive today.