150 Million Identity Documents and a Fake Government Email: The Week Raw PII Stopped Being Defensible

Week of 14 September 2026 | Compiled by Team Paringa

Two identity data losses in one week, one through a year-long cloud intrusion, one through a single fraudulent email, land alongside the first live EU Cyber Resilience Act reporting deadlines. The common thread: the data was readable by whoever asked.

What Happened This Week

🔴 IDScan confirms breach of 150 million+ driver's licences after a year-long cloud intrusion

Louisiana-based identity verification provider IDScan confirmed on 10 September that attackers stole driver's licence records from its cloud environment. The stolen data includes full names, driver's licence numbers, identity numbers from other government documents such as passports, and photographs. IDScan has not put a figure on affected individuals, but its own marketing states it holds more than 150 million driver's licence records covering the United States and Canada.

The scale became public on 1 September when Brian Krebs reported a dark-web site that let anyone search the licence data of 153 million people, photos included. Krebs verified his own record. The database contained the US Secretary of Defense. The Pentagon confirmed awareness and the FBI opened an investigation. IDScan's notice acknowledges a payment demand for full access to the data, which reads as an extortion attempt the company has not addressed publicly.

IDScan's customers are bars, entertainment venues, cannabis dispensaries and retailers that scan IDs at the door. None of those businesses needed a copy of a passport number to confirm someone was over 21. The verification could have returned a yes/no result against a tokenised record. Instead, a downstream vendor accumulated a year of raw identity documents from every scan, and that archive is now the product being sold.

For UK and EU readers this is not a US-only problem. The same pattern applies to any age-assurance, KYC or onboarding vendor holding document images and numbers in the clear. The ICO's Children's Code progress update on 26 August confirmed risk reviews of 14 age-assurance providers are under way; IDScan is the case study those reviews will now cite.

Sources: TechCrunch, Krebs on Security, ICO

IDScan was breached for roughly a year before anyone noticed, which means detection was never going to save this data. The only control that would have worked is one that made the stored data worthless to the attacker: tokenise the licence number and passport number at capture, keep the photo in a vault the application cannot bulk-read, and return a verification result rather than a record. That is a data-layer decision, not a security-tooling decision. Every UK firm using a third-party ID checker should ask this week what that vendor actually stores after the check completes, and for how long. If the answer is "the document", the firm is carrying IDScan's risk under its own UK GDPR controller obligations.

🟡 Revolut discloses customer identity documents to a fraudster using a real government email domain

Revolut confirmed on 12 September that it handed sensitive customer data to an unauthorised third party after receiving fraudulent information requests sent from a legitimate government agency email domain. The data disclosed included dates of birth, postal and email addresses, phone numbers, copies of passports and driver's licences, and potentially verification selfies, account statements and transaction histories. Revolut says a "limited" number of customers were affected and declined to name the agency or the market; researcher ZachXBT reported the targeting appeared aimed at high-net-worth users.

The incident is a legal-request process failure rather than a technical intrusion. Revolut's systems were not breached; its people responded to what looked like a lawful demand, using a workflow that returned raw documents and full transaction histories in one package. With 80 million customers, banking licences in the UK and France, and a conditional US national bank approval granted on 3 September, Revolut now has regulators in at least three jurisdictions who will want to know why a single email could extract that much.

The timing matters for financial services more broadly. Fake emergency data requests using compromised or spoofed government domains have been a known attack pattern since 2022. A response process that pulls unredacted identity documents and statements for any request that passes a domain check is a process designed for the wrong threat model.

Sources: TechCrunch

This is the case for tokenisation that most CISOs miss: the threat was not an attacker in the database, it was a legitimate internal workflow with legitimate access. A law-enforcement response process built on a tokenised data store can be scoped to return only the fields a specific request legally requires, with detokenisation of documents and transaction history gated behind a second approval and logged. That turns a one-email loss into a multi-step, auditable event. UK banks and fintechs should review their legal-request runbooks this month against that standard, because the FCA and ICO will be reading Revolut's answer closely.

🟡 EU Cyber Resilience Act reporting obligations go live, first hard deadline for products with digital elements

From 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe security incidents through ENISA's new Single Reporting Platform. The clock is tight: early warning within 24 hours of awareness, full notification within 72 hours, final report within 14 days (vulnerabilities) or one month (incidents). Weekends and public holidays do not stop the clock. The obligation applies to products already on the market, not only new ones, more than a year before the CRA's main requirements arrive on 11 December 2027.

The Commission's July guidance defines "awareness" as the point at which an initial assessment gives a reasonable degree of certainty that exploitation or a severe incident has occurred. That is the same trigger logic as GDPR Article 33, which means a single incident affecting a connected product with personal data now has parallel 24-hour CRA and 72-hour GDPR reporting tracks until the Digital Omnibus consolidates the channels.

Separately, the Dutch DPA became legally required from 1 September to publish every GDPR sanction it imposes, removing the discretion that previously kept some enforcement quiet.

Sources: Freshfields, Gibson Dunn

Any UK or EU firm shipping software or connected hardware into the EU now has a 24-hour reporting obligation that most incident-response plans were not written for. The practical fix is to decide in advance which product data is personal, which is not, and what the CRA and GDPR notifications will each say, so the first day of an incident is spent on containment rather than legal triage. Firms that have already classified and tokenised personal data in product telemetry will find the GDPR side of that dual report substantially shorter.

What CDOs, DPOs and CISOs Are Dealing With

The IDScan and Revolut incidents share one root cause that no perimeter control addresses: identity documents were stored and served in readable form, so whoever reached the data, whether through a year-long intrusion or a single spoofed email, got the whole thing. Detection failed in one case and never applied in the other. Security budgets keep flowing to monitoring and response, while the data that is actually stolen sits in the same state it was collected in.

The regulatory environment is tightening around exactly this gap. The EDPB's July anonymisation guidelines state that AI models trained on personal data cannot be assumed anonymous and note that agentic AI is reducing the cost of re-identification. National DPAs in France, Germany and Italy have opened investigations into AI-agent deployments, with the most common finding being no documented legal basis for what the agent processed. The Dutch DPA now publishes every sanction. The CRA adds a 24-hour clock. The direction is consistent: regulators are asking what the data looked like at rest, and "encrypted at the disk level" is no longer a satisfactory answer.

Three Things Worth Watching Next Week

1. IDScan customer notifications and downstream controller exposure - IDScan has not disclosed an affected-individual count. Watch for UK and EU businesses that used IDScan or a similar vendor to begin their own Article 33 notifications, and for the ICO's age-assurance risk reviews to reference the case.

2. Revolut regulatory response across UK, EU and US - Revolut declined to name the agency or market. Expect the FCA, ICO and the US OCC (which granted a conditional bank charter on 3 September) to ask for the legal-request process documentation. Any published finding will set the standard for how much data a single request may return.

3. CBUAE AI governance deadline on 16 September - The Central Bank of the UAE's AI Governance Guidance Note deadline lands this week. Licensed financial institutions must show how personal data entering AI systems is controlled; this is the first hard regional deadline that maps directly to data-layer protection rather than policy documents.

Questions? hello@paringa.ai

Paringa combines data-level privacy (tokenisation and pseudonymisation of PII before it reaches applications, AI models or third parties) with managed cyber services in a single wrapper, so the data that gets stolen is worth nothing to the thief. Track A Layer 3 (PROTECT) is where this week's incidents would have been stopped. | 14 September 2026 | © Paringa Ltd