IDScan Confirms Cloud Breach Of 153 Million Licenses

It took four days for IDScan to say the word BleepingComputer had already used to describe it: breach. The company confirmed this week that customer data was 'accessed' inside its cloud platform, the platform behind a database of 153 million scanned American driver's licenses that surfaced in the open. What IDScan has not said is which control failed. As Kai Tanner reports from the Cyber Intel desk, a leak at this scale does not come from a phishing email. It comes from a storage bucket or an access policy that let a customer's data reach the internet, and the company's own disclosure skips the part that would let anyone verify it.

Risky Business read the exposure as a gift to Beijing: Tom Uren and James Wilson argue Chinese intelligence services now hold a scan quality corpus of American identity documents at a scale no prior breach approached. Whether or not that framing holds, the more immediate exposure sits closer to home. Tanner's reporting lays out the mechanics for any APAC bank running IDScan or a comparable vendor for KYC onboarding. 'We outsourced the scan' does not survive an on site inspection when the vendor cannot produce ninety days of access logs on the storage layer itself.

Elsewhere this morning, Aya Nakamura's AI desk has a parallel story about claims outrunning verification. OpenAI says its new model, GPT-6 Astra, cracked a piece of the Navier-Stokes problem, but mathematicians are pushing back on a writeup that skipped independent review, the same week OpenAI froze new ChatGPT Pro signups because Astra demand outstripped what the company could provision. Magnus Honeyfield's Science desk has a UC Davis trial showing brain speech implants calibrate faster when pretrained on other patients' data first: a human trial, not a cleared device. And Mei Chen's Geopolitical desk carries Kevin Rudd's break from diplomatic caution. The outgoing Australian ambassador to Washington now says a Chinese move on Taiwan is more likely, not steadier, the same week Taiwan's navy logged its fourth PLA warship sighting since August.

The lead story comes down to an access control someone did not check, at a vendor whose customers assumed 'cloud' meant 'secure.' The HKMA and MAS both require regulated institutions to know where verification flow data physically sits and who can reach it, and a fresh SFC circular this month extends the same expectation to virtual asset intermediaries. Vendors that can answer that question with a log file are in a different position this quarter than the ones still writing the incident report.