A massive data breach has exposed over 153 million scanned driver's licenses collected by IDScan.net, a Louisiana-based identity verification company. The compromised data, including images from individuals across the US and Canada, was reportedly available for sale on the dark web. Notably, the leak appears to have been ongoing in real-time for over a year, with an additional 400,000 records added on the very day the breach was publicly revealed. Brian Krebs of Krebs On Security traced the breach to IDScan.net, which services thousands of clients including Hertz, FedEx, and Target, as well as numerous cannabis dispensaries. The company also provides age verification services to tech firms and has advocated for legislation like the Kids Online Safety Act (KOSA). Despite claiming compliance with GDPR and CCPA and promoting its security practices through a public Trust Center page, IDScan.net's systems were allegedly leaking every scanned ID as it was processed. The New Orleans field office of the FBI has launched an investigation into the source of the leaked images. The incident underscores long-standing concerns raised by experts like Eric Goldman about the inherent privacy risks of identity and age verification technologies.

This breach reinforces warnings that no form of digital ID verification can guarantee safety, especially as governments push for mandatory age checks online.