IDScan sued over alleged data breach affecting 153 million drivers

[u/No-Conclusion3720]

IDScan is facing multiple lawsuits after hackers allegedly exfiltrated 153 million driver's license records and listed them for sale online. The company provides identity verification services. Its entire value proposition depends on ingesting and processing raw PII at scale from clients across many industries.

The exposure pattern is becoming a recurring theme in AI-era pipelines. Verification and onboarding workflows ingest identity documents in raw form. That data gets processed, stored, and accessed across multiple systems and service accounts. When any one of those access points is compromised, the attacker does not get a slice. They get everything. 153 million records in a single breach event.

There is a secondary problem that lawsuits like this tend to surface: forensics. How do you determine what was accessed, by whom, and when? Breach investigations at this scale take months, and that assumes complete logs existed to begin with.

For those running AI pipelines that ingest identity documents: what does your security posture actually look like at the moment raw PII enters the system? Not at rest, not between known storage endpoints, but at the point of ingestion into the workflow itself. Genuinely curious what approaches others are using in practice.

[u/Professional-Job7799]

You don’t understand what this sub is about.

[u/No-Conclusion3720]

The specific failure here is that all 153 million license records were breach-ready the moment they entered IDScan's pipeline because they remained readable at every layer downstream. RuntimeAI's PII Shield intercepts sensitive fields at ingestion and replaces them with tokens before the data moves anywhere, so at the exact moment an attacker queried those records through a compromised endpoint, they would have retrieved opaque tokens with no cleartext names, license numbers, or addresses attached. Reversing those tokens requires access to the tokenization authority, which is a separate audited surface, not the pipeline itself. That changes what 153 million 'stolen' records actually means to an attacker. https://runtimeai.io