IDScan Breach: 153 Million Driver's Licenses Allegedly Stolen — Third-Party PII Exposure Response Guide

---
title: Mass Export of Identity Document Records from Database
title_note: Detects bulk query/export patterns consistent with PII database theft
id: 3f8c1a42-7b9d-4e51-a6f2-9c4d8e1b2a07
status: experimental
description: Detects database processes or service accounts performing large-scale SELECT/export operations against identity document or PII tables, consistent with bulk theft of driver's license or identity verification records.
references:
  - https://www.bleepingcomputer.com/news/security/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/
  - https://attack.mitre.org/techniques/T1213/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1213
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\sqlcmd.exe'
      - '\bcp.exe'
      - '\mongoexport.exe'
  selection_bulk:
    CommandLine|contains:
      - 'SELECT *'
      - '--all-databases'
      - '--full-export'
      - ' OUT '
  condition: selection_tools or (selection_bulk and selection_tools)
falsepositives:
  - Scheduled backup jobs (whitelist by service account and maintenance window)
  - DBA administrative exports
level: high
---
title: Large Archive Staging in Temporary or Web-Accessible Directories
id: 8d2e5b17-4c6a-4f38-b1d9-2e7a3c5f9b44
status: experimental
description: Detects creation of large compressed archives in temp, webroot, or application directories — a common staging pattern before exfiltration of bulk PII datasets, as seen in identity data breaches where stolen records are packaged for sale.
references:
  - https://www.bleepingcomputer.com/news/security/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|endswith:
      - '.zip'
      - '.7z'
      - '.rar'
      - '.tar.gz'
  selection_path:
    TargetFilename|contains:
      - '\Temp\'
      - '\tmp\'
      - '\inetpub\'
      - '\wwwroot\'
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
  filter_legit:
    Image|endswith:
      - '\MsMpEng.exe'
      - '\TiWorker.exe'
  condition: selection_ext and selection_path and not filter_legit
falsepositives:
  - Application installers staging in temp directories
  - Legitimate backup agents writing to ProgramData
level: medium
---
title: Abnormal Outbound Transfer Volume from Database or Web Servers
id: c41f7e29-9d3b-4a85-e2c6-5b8d1f3a7e92
status: experimental
description: Detects database or web server processes initiating outbound network connections to uncommon external destinations, consistent with exfiltration of stolen identity records to attacker infrastructure or cloud storage.
references:
  - https://www.bleepingcomputer.com/news/security/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\sqlservr.exe'
      - '\mysqld.exe'
      - '\postgres.exe'
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
  selection_outbound:
    Initiated: 'true'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  condition: selection_proc and selection_outbound and not filter_internal
falsepositives:
  - Database replication to cloud DR sites (whitelist known destinations)
  - License/telemetry callbacks from web server processes
level: high

// Hunt: anomalous outbound data volume from servers hosting PII/identity data stores
// Scope: hosts tagged as database or web-front-end servers. Baseline before alerting.
let Lookback = 14d;
let BaselineMultiplier = 3;
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName has_any ("sqlservr", "mysqld", "postgres", "w3wp", "nginx", "httpd")
| where ActionType == "ConnectionSuccess"
| where not(RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172.16.")
| summarize DailyBytes = sum(SentBytes), Destinations = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1d)
| join kind=leftanti (
    // Exclude hosts whose daily volume is within 3x their own trailing baseline
    DeviceNetworkEvents
    | where TimeGenerated between (ago(Lookback) .. ago(1d))
    | where InitiatingProcessFileName has_any ("sqlservr", "mysqld", "postgres", "w3wp", "nginx", "httpd")
    | summarize AvgBaseline = avg(SentBytes) by DeviceName, InitiatingProcessFileName
    | where AvgBaseline > 0
) on DeviceName, InitiatingProcessFileName
| where DailyBytes > 500000000  // >500MB from a DB/web process in a day — tune to environment
| project TimeGenerated, DeviceName, InitiatingProcessFileName, DailyBytes, Destinations
| order by DailyBytes desc;

-- Hunt for staged bulk-data archives on database/web servers
-- Deploy against hosts running identity verification, document storage, or PII databases.
-- Flags recently created archives >100MB in staging-prone directories.

SELECT FullPath, Size, Mtime, Btime,
       basename(path=FullPath) AS FileName
FROM glob(globs=[
    'C:\\Windows\\Temp\\**\\*.zip',
    'C:\\Windows\\Temp\\**\\*.7z',
    'C:\\Windows\\Temp\\**\\*.rar',
    'C:\\inetpub\\**\\*.zip',
    'C:\\ProgramData\\**\\*.7z',
    'C:\\Users\\*\\AppData\\Local\\Temp\\**\\*.zip',
    '/tmp/**.tar.gz',
    '/var/tmp/**.tar.gz',
    '/var/www/**.zip'
], accessor='file')
WHERE Size > 104857600
  AND Mtime > now() - 604800
ORDER BY Size DESC

# Audit-DatabaseAccessScope.ps1
# Reviews SQL Server audit state and recent large-read sessions on PII-hosting instances.
# Run elevated on the database server or against it remotely.

param(
    [Parameter(Mandatory=$true)]
    [string]$SqlInstance,
    [string]$BaselinePath = ".\db_access_baseline.json"
)

# 1. Verify server auditing is enabled — a prerequisite for scoping any breach
$auditCheck = @"
SELECT name, is_state_enabled FROM sys.server_audits;
SELECT name, is_default_trace_enabled = (SELECT value_in_use FROM sys.configurations WHERE name = 'default trace enabled')
FROM sys.server_audits;
"@
$audits = Invoke-Sqlcmd -ServerInstance $SqlInstance -Query $auditCheck -TrustServerCertificate
if (-not ($audits | Where-Object { $_.is_state_enabled -eq 1 })) {
    Write-Warning "No ENABLED server-level SQL audit found on $SqlInstance. You cannot retroactively scope bulk reads without auditing. Enable one now:"
    Write-Host @"
  CREATE SERVER AUDIT [PII_Access_Audit] TO FILE (FILEPATH = 'D:\Audit\', MAXSIZE = 512 MB);
  ALTER SERVER AUDIT [PII_Access_Audit] WITH (STATE = ON);
  CREATE DATABASE AUDIT SPECIFICATION [PII_Table_Reads]
  FOR SERVER AUDIT [PII_Access_Audit]
  ADD (SELECT ON DATABASE::[YourIdentityDB] BY [public]);
"@ -ForegroundColor Yellow
}

# 2. Snapshot currently active sessions with large logical reads (potential in-progress bulk extraction)
$heavyReads = Invoke-Sqlcmd -ServerInstance $SqlInstance -TrustServerCertificate -Query @"
SELECT s.session_id, s.login_name, s.host_name, s.program_name,
       r.logical_reads, r.reads, r.row_count, t.text AS query_text
FROM sys.dm_exec_sessions s
JOIN sys.dm_exec_requests r ON s.session_id = r.session_id
CROSS APPLY sys.dm_exec_sql_text(r.sql_handle) t
WHERE r.logical_reads > 100000
ORDER BY r.logical_reads DESC;
"@

if ($heavyReads) {
    Write-Warning "Active sessions with >100K logical reads detected — review immediately:"
    $heavyReads | Format-Table session_id, login_name, host_name, program_name, logical_reads -AutoSize
} else {
    Write-Host "[+] No anomalous high-read sessions active." -ForegroundColor Green
}

# 3. Compare enabled logins against a stored baseline to catch newly added service accounts
$currentLogins = Invoke-Sqlcmd -ServerInstance $SqlInstance -TrustServerCertificate -Query "SELECT name FROM sys.server_principals WHERE type IN ('S','U','E','G') AND is_disabled = 0"
if (Test-Path $BaselinePath) {
    $baseline = Get-Content $BaselinePath | ConvertFrom-Json
    $newLogins = $currentLogins.name | Where-Object { $_ -notin $baseline }
    if ($newLogins) {
        Write-Warning "New enabled logins since baseline — verify these are authorized: $($newLogins -join ', ')"
    }
} else {
    $currentLogins.name | ConvertTo-Json | Out-File $BaselinePath
    Write-Host "[+] Baseline written to $BaselinePath. Re-run periodically to detect unauthorized account creation."
}