The IDScan Data Breach: What 153 Million Exposed Driver's Licences Means for You

If you've had your driver's licence scanned to prove your age, rent a car, or check into a hotel any time in the last few years, this one's worth two minutes of your time.

In early September 2026, a company called IDScan — which provides ID-checking technology used by major retailers, bars, and rental companies across the US and Canada — confirmed that its systems had been broken into. The attackers claimed to have over 153 million driver's licences, ID cards, travel documents, and even medical cards, and put them up for sale on the dark web. The FBI is now investigating.

Why this one's different

Most of the breaches you hear about involve email addresses and passwords. Annoying, but fixable — you change the password, turn on two-factor authentication, and move on.

This is different. A driver's licence isn't something you can "reset." It's a real, physical form of ID, with your name, date of birth, address, and licence number on it — and in this case, scanned front-and-back copies of the actual document. That's exactly the kind of information criminals use to open credit accounts, take out loans, or pass themselves off as you.

What this means for you

You don't need to know whether you personally were affected by this breach to take the sensible steps below — they're worth doing regardless, because this kind of incident happens more often than most people realise, and it won't be the last.

If you've had your ID scanned anywhere in the last few years (car rental, age verification, hotel check-in, a bar, a delivery service), it's worth treating your identity as if it may already be out there, and taking a few precautions:

• Check your credit report. Most countries let you check this for free at least once a year. Look for accounts or credit checks you don't recognise.

• Consider a credit freeze. This stops new accounts being opened in your name without extra verification. It's free in most places and easy to lift temporarily if you need credit yourself.

• Watch for anything odd. Unexpected bills, accounts you didn't open, or letters about credit applications you didn't make are the earliest warning signs.

• Be extra cautious with unsolicited contact. Scammers often use breaches like this as material — a call or text that already has your real name, address, or partial licence number sounds far more convincing than a random stranger, but it's still a scam.

The bigger lesson

This breach is a useful reminder that not all personal data is equal. A leaked password is bad. A leaked government ID is worse, because it can't simply be changed. It's worth being a little more selective about where you hand over a copy of your ID in future — ask whether a business really needs a full scan, or whether showing it briefly would do.

If you run a business that collects ID documents from customers or staff — for age verification, right-to-work checks, or account setup — this is also a timely prompt to check how that data is stored, who can access it, and how long you actually need to keep it. The businesses affected by this breach didn't lose the data themselves; a supplier they trusted did. Third-party risk is real risk.

Want a plain-English way to check your own digital safety, or to get your business's data handling properly covered? Our Personal Digital Safety Kit and Essential/Enterprise Compliance guides walk through exactly this kind of thing — no jargon, just clear steps.