153 Million ID Scans Leaked. Freeze Your Kid's Credit.

On September 1, security reporter Brian Krebs described a dark web service advertising searchable access to more than 153 million driver's license scans from the United States and Canada. Not just the numbers. The photographs of the licenses themselves.

The same collection reportedly held around 10 million other ID cards, 3 million travel documents and 579,000 medical cards.

Krebs traced the records to IDScan, a company selling identity verification technology. On September 4 it posted a security notice saying it had learned around September 1 that data in its cloud platform may have been accessed without authorization. It confirmed the breach publicly on September 10.

The exposed information can include full names and driver's license or other government issued identification numbers. The FBI is investigating and lawsuits have been filed.

The dark web service was taken offline, though the people who built it almost certainly still hold the data.

Here is the part most coverage skipped: a lot of those licenses belong to teenagers.

Because ID scanning is now routine, and teenagers get scanned more than most adults.

IDScan's technology is used by car rental companies, retailers, financial institutions, hospitality businesses, cannabis dispensaries and gun shops. Any place with a legal reason to confirm you are who you say you are, and old enough to be there.

Think about where a sixteen or seventeen year old gets carded. Buying cough medicine. Picking up a package. Starting a job. Getting into a venue. Opening a first bank account. Some of those scans run through systems like this one.

Your teen did not choose any of it. They handed a license to a cashier, the cashier ran it through a reader, and that was that.

That is the shape of modern data. Your child's most sensitive identifiers sit in systems they never signed up for, held by companies whose names they will never learn.

Adults notice. That is the whole difference.

An adult checks a credit card statement, applies for a loan, or gets a rejection letter and discovers something is wrong within months. A child's credit file is a blank page nobody looks at. Someone can open accounts against a minor's information and it can run for years without a single red flag, because nobody is checking a twelve year old's credit report.

The bill usually arrives at the worst moment. Eighteen years old, applying for a first apartment, a student loan, or a car, and the application comes back denied over accounts opened when they were nine.

Cleaning it up is possible, and it is a slog. Disputes with three bureaus, police reports, affidavits, months of follow up, all while they are trying to start their adult life.

The good news is that prevention here is unusually cheap and effective.

Freeze your child's credit. It is free, it is federal law, and most parents have never heard of it.

The Federal Trade Commission's guidance is direct. If your child is under 16, you can request a free credit freeze that makes it much harder for anyone to open new accounts in their name. It stays in place until you ask for it to be removed. Teens who are 16 or 17 can request and lift a freeze themselves.

You contact each of the three credit bureaus separately: Equifax, Experian and TransUnion. The process for a minor is different from the adult process, so look specifically for the minor or protected consumer instructions rather than clicking the standard freeze button.

Expect to send documents. Usually a copy of your ID, your child's birth certificate, their Social Security card, and proof of address.

Set aside one evening and do all three in one sitting. Then note it in your calendar, because in four years you will not remember.

Worth being clear, because people oversell this.

A freeze stops most lenders from pulling your child's credit file, which stops most new accounts from being opened. That is the main way stolen child data gets turned into money.

It does not delete anything that has already leaked. Their license image, if it was in that collection, is out and stays out.

It does not stop tax related fraud, where somebody uses a child's Social Security number on employment paperwork. It does not stop medical identity theft. And it is not a scam blocker, so it does nothing about the phone call claiming your teen owes money.

So it is not everything. It is the highest value thing you can do in one evening, and free and permanent makes it a good trade.

The FTC lists warning signs that a child's information is already being used. They are easy to miss because they look like clerical errors.

Someone contacts you about an overdue bill in your child's name for an account you never opened. A collections letter arrives addressed to a nine year old. The IRS sends a notice about unpaid income taxes for your child, which usually means somebody used their Social Security number on employment forms.

Your child gets pre approved credit card offers in the mail. One means very little. A steady stream means a file exists.

Or you are denied government benefits for your child because they are already being paid to an account using their number.

If any of that shows up, report it at IdentityTheft.gov, the FTC's official site, which produces a recovery plan and the affidavits you will need.

One check worth doing now: ask each bureau whether a credit file exists for your child at all. For a young child, the correct answer is that none does.

If your teenager works, sells things, or runs anything of their own, this is a useful moment rather than a scary one.

The idea to hand them is that their identity is now an asset they manage, the same way they manage a bank balance. Three habits cover most of it.

Do not photograph your license and text it to anybody, including a landlord, an employer or a coach. Send it through a method that expires, or hand it over in person.

When a business asks for a Social Security number, ask why and whether something else will do. Often it will.

Keep your documents in one place you control rather than scattered across camera rolls and group chats.

For a teen already running something small, the same discipline covers the business side. Keep the paperwork, income records and account details in one place, whether that is a physical folder, a spreadsheet, or a planning tool like Foundra that walks a first time founder through the pieces one at a time. Same habit, bigger stakes later.

Do not buy an expensive identity monitoring subscription out of panic. Companies involved in breaches typically offer free monitoring to affected people, and the free freeze does more of the protective work than most paid monitoring. Monitoring tells you after something happened. A freeze tries to stop it.

Do not assume you are unaffected because nobody notified you. Notification here is slow, incomplete and sometimes quiet. In this case the company's own notification page carried a setting telling search engines not to index it.

Do not skip the younger kids. Parents freeze the teenager's credit and stop, but younger children are the better target precisely because nobody will look for a decade.

And do not turn this into a lecture about the internet being dangerous. Your teen handed a license to a cashier. That is not a mistake they made. It is a system they were born into, and the useful response is the forty minute one.

• A dark web service was found advertising more than 153 million US and Canadian driver's license scans, traced back to identity verification company IDScan, which confirmed a breach on September 10, 2026.
• Teenagers are heavily represented because ID scanning is routine at retailers, employers, venues and rental companies.
• Child identity theft often runs undetected for years, surfacing when a young adult first applies for credit.
• A credit freeze for a child under 16 is free, permanent until removed, and requested separately from each of the three bureaus using their minor or protected consumer process.
• A freeze does not undo a leak, stop tax related fraud, or replace attention. It does block the most common path to money.
• Report anything suspicious at IdentityTheft.gov rather than buying a subscription first.

My child is four. Is a credit freeze really necessary? It is more useful at four than at fourteen. Young children have no reason to touch their credit for well over a decade, so a fraudulent file can sit undisturbed that entire time. The freeze costs nothing and needs no maintenance.

Will a freeze hurt my child later when they want a card or a loan? No. They lift it when they need it, which takes minutes online once they have their own credentials. It does not affect their future score, and it does not appear on their report as a negative mark.

What documents will the bureaus ask for? Generally a copy of your government ID, your child's birth certificate, their Social Security card, and a recent utility bill or bank statement showing your address. Each bureau lists its own requirements, and each handles minors differently from adults.

Should I take the free credit monitoring being offered? Take it if it costs nothing. Just do not treat it as the protective step. Monitoring reports damage after the fact. The freeze is what prevents it.

How do I know if my teen's license was in this collection? You probably cannot know for certain, and chasing that answer is not a good use of your evening. Assume exposure, freeze the credit, watch for the warning signs. The response is the same either way.

1. TechCrunch: ID verification giant IDScan confirms data breach with more than 150 million driver's licenses stolen
2. BleepingComputer: IDScan confirms breach tied to 153 million stolen driver's licenses
3. KrebsOnSecurity: FBI probes service selling 153M driver's licenses
4. FTC Consumer Advice: How To Protect Your Child From Identity Theft
5. FTC Consumer Advice: Credit Freezes and Fraud Alerts