CuraSec

tag: Identity-Verification · 2 items

Act archived IDScan breach exposes 153 million driver's license scans
2026-09-10 · BleepingComputer · source ↗ #vendor-breach#identity-verification#data-breach
  • Engineer — Plan: If your org uses IDScan’s API or SDK for customer identity verification, audit the integration to determine what PII flows to their cloud and whether your API credentials may have been exposed; no patch action, but a data-inventory and vendor-access review is warranted.
  • SOC/IR — Learn: A breach of this scale at an identity-verification vendor could fuel downstream account-takeover campaigns using stolen DL scans as identity proofs, but no IOCs or TTPs have been published to hunt on yet; monitor for follow-on reporting.
  • Leader — Act: Confirm whether your organization uses IDScan for any identity-verification workflow, request their formal incident disclosure and scope attestation, and assess whether your customers’ data is among the 153 million records; brief legal on potential notification obligations if exposure is confirmed.
Act archived IDScan sued over breach allegedly exposing 153M driver's licenses
2026-09-05 · BleepingComputer · source ↗ #data-breach#identity-verification#litigation
  • Engineer — Skip
  • SOC/IR — Learn: A breach at a major identity verification vendor exposes the scale of risk in third-party ID data aggregators; no IOCs or TTPs published yet to act on.
  • Leader — Act: If your organization uses IDScan for identity verification, confirm your vendor exposure now and request an incident attestation; this scale of driver license exposure may trigger customer or regulatory inquiries regardless of direct involvement.