153 Million Driver's License Records Exposed in IDScan Cloud Breach
IDScan, a company trusted to verify sensitive identity documents, failed to prevent unauthorized third-party access to a cloud platform storing over 153 million driver's license scans — one of the most sensitive categories of personally identifiable information (PII). The root cause points to inadequate access controls and insufficient monitoring on cloud-hosted data repositories, allowing a threat actor to exfiltrate an enormous dataset without timely detection. This incident is particularly damaging because driver's license data is largely immutable — victims cannot easily change their license numbers, dates of birth, or physical attributes. It also highlights the compounding risk when identity verification vendors are breached, as their core business model requires holding highly sensitive data at scale, making them high-value targets for cybercriminals.
Tactical Insight
Immediate actions
- Audit and revoke all unnecessary cloud storage access permissions, enforcing least-privilege principles across all accounts.
- Enable real-time alerting for anomalous data access patterns, such as bulk downloads or access from unfamiliar IP addresses.
- Encrypt all stored identity document scans at rest using AES-256 or equivalent standards with strict key management controls.
Long-term improvements
- Implement a Zero Trust architecture requiring continuous verification for all access to sensitive cloud data stores.
- Minimize data retention by purging identity scans once verification is complete, reducing the value of any future breach.
- Conduct regular third-party penetration testing and cloud security assessments focused on data exfiltration scenarios.
Detection & response measures
- Deploy a Cloud Access Security Broker (CASB) to monitor, log, and control data movement across cloud platforms.
- Establish a documented incident response plan specifically for large-scale PII breaches, including regulatory notification timelines.
- Integrate SIEM tooling to correlate access logs and trigger automated containment actions upon detecting mass data transfers.