When the ID Scanner's Vendor Is Hacked, Your Customers' Licenses Go With It
IDScan confirmed in September 2026 that hackers reached license data stored in its cloud for businesses that scan IDs. Here's what to ask your own vendor.
Your customer's license leaves your counter long after the customer does if your scanner keeps a copy.
What to do this week: Ask every vendor that scans IDs for you what it stores, where, and how long it keeps it — in writing.
That question matters now. Krebs on Security first reported on September 1, 2026, that a dark-web service was offering scans tied to IDScan, and TechCrunch reported on September 10 that IDScan confirmed hackers stole driver's licenses from its cloud. For a small shop, the product bought to stop fake IDs became a storehouse of real ones.
The vendor confirmed the theft, not a final count
IDScan said in a September 4 notice, reported by TechCrunch on September 10, 2026, that it first learned of possible unauthorized access around September 1. The company said names and driver's license or other government-ID numbers may have been copied, and its investigation was still going.
IDScan has not given a count of affected people, TechCrunch reported, though the company advertises a database of more than 150 million license records. A database size is not a victim count, and we don't treat it as one.
A searchable criminal catalog is different from a lost file
Brian Krebs reported that the service claimed more than 153 million U.S. and Canadian driver's licenses, plus other identity documents, as of September 1, 2026. Krebs wrote that he checked his own license record and helped others confirm theirs, which is how he verified the data was real.
Krebs also reported the listed count rose by nearly 400,000 in 24 hours. Our calculation: 400,000 divided by 24 is about 16,700 records an hour in that window, which suggests fresh data was still arriving then — not a single old dump sitting still.
Think of it like a card catalog at a library, except the cards are licenses and anyone willing to pay can look up a name. A stolen filing cabinet is bad; a searchable catalog is easier to use again and again.
The other side
TechCrunch reported on September 10, 2026, that IDScan did not respond to its request for comment on whether hackers demanded a ransom. Krebs reported that IDScan told him it was investigating and welcomed his updates. No ransom claim is confirmed in these sources.
IDScan's notice says 'full access to the information required payment,' which TechCrunch read as likely referring to the hackers' paid access. IDScan has not explained the phrase.
A Pentagon spokesperson told TechCrunch the Defense Department was aware of the suspected breach, and an FBI spokesperson told TechCrunch the bureau was investigating. Krebs reported the FBI's New Orleans field office opened an inquiry on September 1, 2026.
What this means for Southwest Michigan
Bars, cannabis shops, hotels, rental counters, and age-restricted retailers around Allegan, Plainwell, Otsego, and Kalamazoo may scan IDs even if they have never heard IDScan's name. The risk sits with the vendor behind the scanner, not only with the clerk holding it.
Ask three things: Do you keep the full license image or only a yes-or-no result? How long do you keep it? How will you tell us, and how fast, if it is copied? If a vendor cannot answer plainly, that answer matters too.
Customers can watch for a notice from IDScan or a business where they showed ID, watch credit reports, and be wary of messages that quote a license number to sound real. IDScan says it is offering free credit monitoring, and anyone can place a free credit freeze with Equifax, Experian, and TransUnion. A license number alone does not prove a caller is a bank or an agency.
One thing to do this week: email your ID-scanning vendor the three storage questions above and keep the reply with your insurance papers.
Disclosure: Cybercave Technologies, LLC provides IT services to small businesses. No company named in this article paid for, sponsored, or reviewed it.
This article is general information, not advice for your specific situation.
Sources (accessed October 17, 2026)
- Primary — IDScan notice (September 4, 2026, via South Carolina Department of Consumer Affairs breach-notice filing): names and driver's license or other government-ID numbers may have been affected; investigation ongoing. https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20IDScan.net_.pdf
- Krebs on Security, Brian Krebs, September 1, 2026 (first reported the Nexus service and the IDScan link; independently verified his own and others' records): https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/
- TechCrunch, Zack Whittaker, September 10, 2026 (independent confirmation reporting; IDScan confirmed theft to its notice; IDScan did not respond to TechCrunch on ransom): https://techcrunch.com/2026/09/10/id-verification-giant-idscan-confirms-data-breach-with-more-than-150-million-drivers-licenses-stolen/
- BleepingComputer, September 2026 (independent trade coverage of the confirmation): https://www.bleepingcomputer.com/news/security/idscan-confirms-breach-tied-to-153-million-stolen-drivers-licenses/
Independence note: Krebs (2) originated the reporting; TechCrunch (3) and BleepingComputer (4) separately confirmed IDScan's notice; the company notice (1) is primary. That is at least 3 independent sources. No X source counted.
Human-scale math: 400,000 records ÷ 24 hours ≈ 16,667/hour — our calculation, derived from Krebs's 24-hour increase as of September 1, 2026.
General information only. Corrections: support@cybercavetech.com