You Handed Your Licence to a Bouncer. Here's Where It Went

What happened in the IDScan.net breach?

You've done it a hundred times. You hand your licence to someone at a door, a rental counter or a reception desk. They pop it into a scanner, glance at the screen and hand it back. Most people assume the machine checks the card and forgets it.

The IDScan.net breach shows what can happen instead. IDScan.net is a US identity-verification company. Its scanners are the kind venues and retailers use to check your licence at the door, and its customers include car-rental firms. At the end of August, security journalist Brian Krebs was tipped off about a new identity-theft service called "Nexus", advertised on a Russian-language forum. To prove the data was real, the seller sent Krebs a copy of his own Virginia driver's licence.

The haul on offer was more than 153 million driver's licences, over 10 million other ID cards, more than 3 million travel documents and over 579,000 medical cards, with photos. Later breach roundups put the total above 170 million records, although that larger figure is still a claim. The FBI's New Orleans field office has opened an inquiry, and IDScan.net confirmed the breach on 10 September.

Many of the people affected had no relationship with IDScan.net at all. Their only connection was that they once rented a car or walked into a bar.

I'm in Australia. Why should I care?

The licences in the IDScan.net sale are overwhelmingly American and Canadian. But the pattern is familiar here. Australians saw it with Outabox, the venue sign-in system at the centre of an earlier leak of club patrons' licence details. IDScan.net is the same problem at a far bigger scale.

Scanning happens everywhere in Australia too. Pubs and clubs scan at the door. Car-rental counters photocopy your licence. Dealerships, real estate agents and pawnbrokers keep copies for their files. The OAIC's 2026 privacy policy sweep is looking at exactly these industries: real estate, pharmacy, licensed venues, car rental, car dealerships and pawnbrokers.

And these businesses do get breached. In September alone, a Tweed Heads car dealership was listed by a ransomware group, and dealerships routinely hold licence scans and finance applications. Samples leaked from a Victorian engineering firm included an employee's passport scan. Overseas, the digital bank Revolut confirmed that copies of customers' passports and driving licences were sent to someone who had faked official data requests from a real government email domain. Nobody broke anything. The process just handed the documents over.

Why is a leaked licence worse than a leaked password?

Security researchers call a scanned licence a "master key", and it's a fair description. A licence image carries your full name, date of birth, address, signature, photo and a government-issued number, all verified by the state. That's exactly the set of details used for account recovery, credit applications and the "know your customer" checks banks and telcos run. A password opens one account. A licence can help someone open new ones in your name.

The deeper problem is that you can't rotate it. When a password leaks, you change it and the old one becomes useless. When a licence leaks, your name, date of birth and photo stay the same for years. The best you can do is swap the card number, which is a trip to your state's transport agency and some paperwork.

That's why the defence against ID-document breaches isn't a clever reset. It's exposure: fewer copies of your licence in fewer places, kept for less time.

Who has a copy of your licence, and how long can they keep it?

Here's a question most of us have never asked: which venues, gyms, rental agencies and car yards have a scan of my licence, and how long do they keep it?

Under the Privacy Act, an organisation covered by the Act has to destroy or de-identify personal information once it no longer needs it for the purpose it was collected for. In practice, a lot of businesses keep everything, because storage is cheap and deleting things takes effort.

This is where the asymmetry gets frustrating. If you ask a government agency what it holds about you, there's a formal process and a legal obligation to answer. Ask a venue's scanning vendor, often a company in another country that you've never heard of, and you may struggle to find out who to ask at all. They got your data in ten seconds at the door. Getting it back out will take much longer.

You're still entitled to ask. Under the Australian Privacy Principles you can request access to the personal information an organisation holds about you, and ask why it's still being kept.

What to do this week

You can't undo past scans, but you can shrink the problem from here on and make a stolen licence much less useful.

1. Ask before you hand it over. At a venue or counter, ask whether they need to scan it or just look at it, whether the scan is stored, and for how long. If a visual check is enough, say you'd prefer that. Where your state offers a digital licence, the app can often show proof of age without handing over the full card.
2. Ask for deletion where you've been scanned before. For a gym, rental agency or car yard you no longer deal with, email them, ask what ID records they hold about you, and ask them to delete anything they no longer need. Keep a copy of the request.
3. Replace your licence card number if it's been exposed. Most Australian state and territory transport agencies will issue a new card number if your licence details have been caught up in a data breach. Search your state road agency's website for "replace licence card number data breach" to find the process and any evidence they need.
4. Put a ban on your credit file. If you think your ID is in the wild, you can ask Australia's credit reporting bodies to place a free ban on your credit report, which stops new credit being approved in your name while it's in place.
5. Watch for IDLock. Announced on 31 August, IDLock will sit inside myGov and let you block, unblock and monitor the use of your identity documents for online verification. The system underneath it has blocked more than 830,000 fraudulent verification attempts since late 2022. Small-group testing starts later this year, with a national rollout in 2027.
6. Check your email on Have I Been Pwned. It's free, and a leaked email alongside a leaked licence is what makes a convincing scam. If you're worried your identity is being misused, IDCARE, Australia's free not-for-profit identity support service, can walk you through next steps.

Lock down the accounts a stolen ID can unlock

A stolen licence is most dangerous when it's paired with a weak account. Criminals use ID details to talk their way through account recovery: they call a telco, email a support desk or fill in a "forgot my password" form, answering the security questions with details lifted straight off your licence.

So the most important accounts to protect are the ones that can reset everything else: your main email, your mobile phone account, your bank and myGov. Give each one a long, unique password you don't use anywhere else. Turn on two-step verification, ideally with an authenticator app or security key rather than SMS. Ask your mobile provider to add a PIN or password to your account so nobody can move your number to a new SIM with a few personal details and a convincing story.

A password manager makes this realistic. Nobody can remember forty unique passwords, and you shouldn't have to. We keep a separate site, NoSpyPassword, that compares the password managers that hold up under scrutiny, which is a useful next stop if you're setting this up for the first time.

Compare password managers at NoSpyPassword →

If a business won't tell you what it holds

Start with the business itself, in writing. Give them 30 days. If they ignore you, won't explain why they're still holding your scan, or you believe they've mishandled it, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC). If you're in the UK, the ICO handles these complaints. In the EU, it's your national data protection authority.

It's slow, and some businesses will stonewall. But every request costs them a little time, and repeated complaints about the same industry are exactly what the regulator's current sweep is looking for.

The bouncer only needed ten seconds with your licence. You don't have to accept that the copy lives forever.