ID verification giant IDScan confirms data breach with more than 150 million driver’s licenses stolen

There's a bitter irony in the IDScan breach: the entire purpose of this company is to prove that people are who they claim to be, and yet it has now handed criminals the exact materials needed to impersonate more than 150 million of them. Identity verification firms are the bouncers of the digital economy — they check the IDs of anyone opening a bank account, applying for a loan, or passing a KYC check. But bouncers don't usually hold a copy of every ID they've ever scanned. IDScan did, and that aggregation made it a honeypot of unprecedented scale. This is the core structural problem with the modern identity stack: we've outsourced trust to a handful of verification vendors, and in doing so, we've concentrated the world's most sensitive data into single points of failure. A breach at one company doesn't just expose records — it compromises the trust layer that countless downstream services depend on. When a bank sees a verified ID from a vendor like IDScan, it assumes the verification was sound. But if the vendor's own vault has been cracked, that assumption collapses. The entire chain of digital trust is only as strong as its most vulnerable link, and this link just failed catastrophically. The damage profile here is also fundamentally different from a typical credential leak. A stolen password can be changed. A stolen credit card can be canceled. A stolen driver's license number, date of birth, and legal