FlagThis — Daily Cybersecurity Intelligence Briefing

A massive-scale exfiltration involving over 153 million high-fidelity digital scans of driver's licenses has been identified from a Louisiana-based identity verification provider. The compromised dataset includes high-resolution identification documents from the United States and Canada, which have surfaced on a newly established dark web identity theft service. Because the stolen data consists of digital images rather than simple text, it presents a critical risk for bypassing Know Your Customer (KYC) and automated identity verification protocols through advanced spoofing. The FBI's New Orleans field office has launched a formal investigation to determine if the breach resulted from API exploitation, cloud storage misconfigurations, or an insider threat.

An identity verification (IDV) supply chain compromise allegedly targeting idscan.net has exposed between 153 million and 170 million driver's license records from the United States and Canada. Exfiltrated data consists of high-resolution digital scans of government-issued IDs and associated PII, including full names, dates of birth, and residential addresses. Technical investigations are currently targeting API endpoint exploitation, unauthorized third-party access tokens, or cloud storage misconfigurations as the primary breach vectors. This compromise creates systemic risk by undermining the KYC/AML integrity of downstream financial services, enabling high-fidelity synthetic identity fraud and sophisticated account takeover (ATO) attacks.

An unprotected, internet-facing Advance Passenger Information System (APIS) database, reportedly managed by Vietnam-linked entities, has exposed approximately 220.8 million records. The breach encompasses highly sensitive datasets including full legal identities, passport numbers, flight itineraries, and crew records spanning from January 2017 to April 2026. The lack of access controls allowed unauthorized access to a centralized repository of international travel data. This exposure presents critical risks of large-scale identity theft, passport forgery, and targeted espionage via the physical tracking of high-value passengers and aviation personnel.

In May 2026, the threat group ShinyHunters exfiltrated 234 GB of sensitive data from dental benefits administrator DentaQuest. The breach compromised Protected Health Information (PHI) and Personally Identifiable Information (PII), including Social Security numbers and longitudinal clinical records for an estimated 26 million individuals. Initial forensic indicators suggest the attack vector involved either credential stuffing or the exploitation of third-party software vulnerabilities. Following unsuccessful ransom negotiations, the actor published the dataset on a Tor-based leak site. The incident has triggered investigations by the HHS Office for Civil Rights and multiple class-action lawsuits, highlighting the high-value nature of healthcare administration datasets for identity fraud.