aviatrix logoAviatrix
Under Active Attack

Executive Summary

In September 2026, identity verification company IDScan confirmed a significant data breach affecting over 153 million driver's license scans and personal identification documents. Threat actors gained unauthorized access to IDScan's cloud platform, compromising customer data including full names, driver's license numbers, and scanned copies of government-issued IDs. The stolen data was subsequently advertised on a dark web platform called 'Nexus' before being taken offline following FBI investigation. IDScan provides identity verification services to car rental companies, financial institutions, cannabis dispensaries, and hospitality businesses across the US and Canada.

This incident highlights the growing threat to identity verification infrastructure as cybercriminals increasingly target centralized repositories of sensitive personal data. The breach demonstrates how third-party service providers handling critical identity documents have become high-value targets, creating cascading privacy risks across multiple industries that rely on these verification services.

Why This Matters Now

Identity verification breaches are surging as cybercriminals target centralized repositories of government IDs and biometric data. With remote verification becoming standard across industries, these attacks expose millions to identity theft and fraud, making robust third-party security assessments critical.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The breach exposed over 153 million driver's license scans, 10 million ID cards, 3 million travel documents, and 579,000 medical cards, along with full names and identification numbers.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have significantly constrained the IDScan breach by implementing segmented cloud access controls and east-west traffic enforcement. The attack's scope across multiple data repositories would likely have been reduced through workload isolation and identity-aware routing policies.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Cloud native security fabric would likely have constrained the attacker's initial reachability by implementing identity-aware access controls and reducing the attack surface across cloud workloads

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero trust segmentation would likely have limited privilege escalation by constraining access scope to only necessary resources and reducing the blast radius of compromised credentials across customer data repositories

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic security would likely have constrained lateral movement between cloud workloads by enforcing inspection and policy controls on inter-service communications accessing customer data stores

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and control would likely have detected and constrained command and control communications by monitoring abnormal outbound traffic patterns and unauthorized external connections from cloud workloads

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security and policy enforcement would likely have constrained the massive data exfiltration by limiting outbound data transfer volumes and blocking unauthorized external destinations for sensitive identification documents

Impact (Mitigations)

While the reduced scope of accessible data through segmentation controls would likely have limited the volume of records available for dark web sale and decreased the overall impact on affected individuals

Impact at a Glance

Affected Business Functions

  • Identity Verification Services
  • Document Authentication Processing
  • Customer Data Management
  • Compliance and Regulatory Reporting
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Massive exposure of personally identifiable information including full names, driver's license numbers, government-issued identification numbers, and scanned images of driver's licenses affecting over 153 million individuals across the US and Canada. Additional exposure includes 10 million ID cards, 3 million travel documents, and 579,000 medical cards.

Recommended Actions

  • • Implement Zero Trust Segmentation to prevent lateral movement between customer data repositories and limit blast radius of cloud breaches
  • • Deploy Egress Security & Policy Enforcement to detect and block large-scale data exfiltration attempts to unauthorized destinations
  • • Enable Multicloud Visibility & Control to monitor anomalous access patterns and detect unauthorized data access across cloud environments
  • • Establish Encrypted Traffic controls to protect sensitive data in transit and prevent interception during exfiltration attempts
  • • Implement Threat Detection & Anomaly Response to baseline normal data access patterns and alert on suspicious bulk data operations

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image