S0:E26. IDScan.net suspected data breach, toxic data, and TPRM in general.

In this episode of Breach Please, Jake and Jess talk about the suspected IDScan.net breach. We discuss whether a situation like this is a data breach for your org if you "only" use a third party processor to verify identity. We decide this is a question best left for external counsel (with the cover of their malpractice insurance). We discuss the difficulties of saying "third party risk management will fix this" and challenge snake oil vendors not to use that line. Finally, we discuss how we might change architecture of our applications in the future.Source article: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/