IDScan.net's breach notice puts 153 million licenses in cloud accounts it kept after the check

Hand a license across a rental counter and the service you bought is a check: is the document real, is it yours. IDScan.net's notice describes what sat behind that check. An unauthorized third party "may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud," the notice says ^[4]. Those accounts belong to IDScan's business customers. The records were still in them.

A verification service can answer pass or fail and keep nothing after it answers. This one held full names and government-issued identification numbers in per-customer cloud accounts, on the evidence of its own notice ^[4][5]. That is a product decision, and it is the one an operator can inspect before signing.

The public record does not show why the records were there. The notice gives no retention period and does not say whether keeping the data was a client setting or a vendor default ^[3][4].

A notice that crawlers cannot index reaches only people who already know the vendor's name, and most people who scanned an ID at a store counter never learned it ^[13]. Brian Krebs, the cybersecurity journalist who first reported the dark web site selling access to millions of US and Canadian licenses, found the notice himself ^[2][12]. IDScan says it is giving affected users free credit monitoring and identity protection, and urging them to be vigilant against phishing and fraud ^[9].

Four class actions a week ago, more than a dozen now: at least eight new filings in seven days, better than one a day ^[14][15].

For anyone renewing an identity-verification contract, the useful exercise is two columns per vendor. What it returns to you, and what it holds after it returns it. Then two questions about the second column. Can your team delete those records without opening a support ticket, and does the default keep or discard?

Four cases fall out. Discard by default with self-serve deletion is the one to buy. Keep by default with self-serve deletion is a configuration job you can finish this week. Discard by default with deletion only through the vendor needs a written confirmation and a date on it. Keep by default with vendor-controlled deletion means you answer for records you cannot reach, and the customer who scanned the ID will call your store, not the vendor's office.

IDScan, based in Louisiana, has not responded to PCMag's requests for comment ^[11].