by Timothy Page

In early September 2026, a dark-web service began advertising digital scans of more than 153 million U.S. and Canadian driver’s licenses, according to a recent TechCrunch article, along with millions of other ID cards, passports, and medical or cannabis cards. Cybersecurity researchers quickly traced the data to IDScan.net, a Louisiana company that provides identity-verification technology used at car-rental counters, retail stores, FedEx locations, gun shops, and more than 1,000 cannabis dispensaries. Currently, Vermont has over 100 recreational dispensaries of cannabis.

The company later confirmed that an unauthorized party may have accessed or copied customer information stored in its cloud systems. The exposed data can include full names and driver’s license or other government-issued identification numbers. Independent reporting indicates that high-resolution scans—including photos, addresses, dates of birth, and physical descriptions—were also available, as detailed in coverage from CNET and PCMag.

This is not a typical password or credit-card breach. A stolen driver’s license is far more dangerous. It does not expire on your schedule, and most states will not simply reissue one because the data appeared online. Criminals can use the information to open new credit accounts, take over existing ones, file fraudulent tax returns, create synthetic identities, or craft highly targeted phishing attacks. People who need to stay hidden—such as survivors of domestic violence—face added physical-safety risks because the data includes photos and home addresses, according to security analyses reported by Tucker Ellis and others.

Vermont residents are not immune. The state has roughly 480,000 licensed drivers. Local cannabis dispensaries routinely scan IDs to verify age, and national chains that use IDScan’s systems operate here. Vermont law places few limits on businesses scanning or storing ID data, so anyone who recently rented a car, shopped at certain retailers, or visited a dispensary could be affected.

No official count of affected Vermonters has been released, and there is no evidence of a Vermont-specific targeting. The risk is the same nationwide: if your license was scanned at a business using IDScan’s technology, your personal details may now be circulating among identity thieves. The FBI’s New Orleans field office has opened an investigation, and multiple class-action lawsuits were filed within days.

What average people can and should do right now

Treat the possibility of exposure seriously and act quickly.

First, place a free credit freeze with all three major credit bureaus—Equifax, Experian, and TransUnion. A freeze stops most new accounts from being opened in your name and is one of the strongest protections available.

Second, contact IDScan’s dedicated line at 1-833-516-2980 (Monday–Friday, 8 a.m. to 8 p.m. Eastern) to enroll in the free credit monitoring and identity-protection services the company is offering. You can also write to them at the address listed in their official incident notice.

Third, monitor your bank and credit-card statements more carefully than usual for the next several months. Consider requesting a free IRS Identity Protection PIN to block fraudulent tax filings. If you believe your specific license was exposed, contact the Vermont Department of Motor Vehicles to ask about replacement options or additional steps.

Stay alert for phishing texts, emails, or calls that mention the breach or ask you to “verify” your license number. Legitimate companies will not demand sensitive information this way. If you see signs of identity theft, visit IdentityTheft.gov to create a personal recovery plan and report the problem.

The FBI is investigating, and multiple class-action lawsuits have already been filed. Those legal efforts may eventually offer some relief, but they will not reverse the exposure of your data. The practical steps listed above are the most effective protections available to ordinary people today.

This breach underscores a simple reality: every time you hand over your driver’s license for scanning, that data can be stored and later stolen. Until better safeguards become standard, the best defense is freezing your credit, monitoring accounts closely, and treating any possible exposure as real.