A company that sells identity fraud protection just had to admit it may have exposed your identity. That’s not irony, that’s a business model failing at its most basic level. IDScan.net, a platform that helps businesses verify government-issued IDs, has announced it is offering free credit monitoring and identity protection services to customers caught up in a recent data breach. The announcement is careful, corporate, and notably quiet about what this breach may have actually enabled.
According to IDScan.net, “an unauthorized third party may have accessed and/or copied certain customer information” stored in its cloud. The exposed data potentially included full names and driver’s license or other government-issued ID numbers. The company adds that full access to the stolen data “required payment,” which is a strange detail to include in a breach notification. It does not make the situation better.
What IDScan hasn’t said publicly is whether this breach has any connection to a story that broke just days earlier. On September 1, journalist Brian Krebs reported on his blog KrebsonSecurity that a dark web marketplace called Nexus was selling scans of more than 153 million US and Canadian driver’s licenses, along with millions of other ID documents. Krebs cited IDScan as a possible source for the documents being sold. Nexus reportedly shut down ahead of an FBI investigation. IDScan says it is “cooperating with federal law enforcement,” but has not drawn any line, public or otherwise, between its breach and Nexus.
The timing makes that silence hard to ignore. A dark web ID marketplace with over 153 million records shuts down under FBI scrutiny one week, and the following week, a company specifically named as a possible source quietly announces a breach and offers free credit monitoring. These may be unrelated. But any journalist or regulator looking at this would ask the obvious question.
This matters beyond IDScan specifically. The company sits in a part of the industry that handles some of the most sensitive documents people carry, government-issued IDs that unlock financial accounts, employment verification, and age-gated services. When these platforms are breached, the damage is not like losing a password. Driver’s license numbers tied to real names and photos are exactly what identity thieves need to open fraudulent credit lines or build convincing fake identities.
Free credit monitoring is the standard corporate response to breaches now. It’s a one-year subscription to a service that tells you after the damage is done. So if you’re an IDScan customer, take the free monitoring. But don’t mistake it for accountability.