My driver's license or passport was leaked. What should I do?
ID scans have become one of the most common kinds of leaked data. They are collected when bars, car rental desks, cannabis shops and apps check your age or identity, and the companies doing those checks keep being breached. In September 2026, researchers and journalists reported that IDScan, a US verification company, had been breached. More than 150 million US and Canadian driver’s licenses and passports, including photos, were being sold online, with new scans added daily. The FBI is investigating. Over the past two years, smaller leaks have hit other verification vendors and a Discord support vendor that held ID photos from age appeals.
You usually cannot find out where your ID was scanned. If you have shown ID at a bar, rental counter, dispensary or online age check in the past few years, it is reasonable to act as if it could be in one of these leaks.
1. Freeze your credit (US: free, about 15 minutes). A freeze stops lenders from opening new credit in your name, which is the main way a stolen ID gets used. Do it separately at Equifax, Experian and TransUnion, from each bureau’s own website. You can lift a freeze temporarily when you apply for credit yourself. In Canada, contact Equifax Canada and TransUnion Canada for a fraud alert, or a security freeze where your province offers one.
2. Turn on alerts. Set up transaction alerts in your banking and card apps, and an alert for new devices or new payees if your bank offers it. These catch misuse of existing accounts, which a freeze does not cover.
3. Be suspicious of anything that mentions the breach. Scammers send fake “your ID was in a breach” emails, texts and calls within days of the news. They link to fake monitoring sign-ups or ask you to “verify” your ID again. Never upload an ID photo or a selfie through a link in a message. If the company offers free monitoring, sign up from its own website, typed into your browser.
4. Report misuse if it happens. In the US, IdentityTheft.gov (run by the FTC) gives you a recovery plan and an official report. In Canada, report to the Canadian Anti-Fraud Centre and your local police.
5. Ask about a new number only if it is actually being misused. Some US states will issue a new driver’s license number to identity theft victims, usually only with proof of misuse such as a police or FTC report. A leaked passport number is not by itself a reason to replace a passport, but report the passport lost or stolen if the physical document goes missing.
Fewer copies is the long-term fix. When a service asks you to prove your age or identity, choose the option that shares the least, as explained in Should I upload my ID to verify my age?. Passkeys and an authenticator app on your main accounts make a stolen ID much less useful to anyone trying to take them over.