Vendor Risk Management: 5 Moves After the IDScan Breach

Identity checking company IDScan has confirmed that hackers pulled driver’s license records out of its cloud systems, TechCrunch reported on September 10. The stolen material includes full names, license numbers, and ID numbers lifted from passports and similar official paperwork. IDScan says on its own site that it holds more than 150 million license records, so this is a vendor risk management problem for thousands of businesses at once.

Here is why it lands on your desk. Your customers handed their documents to you, not to your supplier, and they will not care whose logo appears on the notice. I learned this the expensive way after a payments processor went dark on a Friday, and the lesson stuck.

1. Map Every Supplier That Touches Customer Identity

Most founders cannot name every vendor holding their users’ personal data. That is not carelessness, it is drift. Tools get added during launches, trials turn into production, and nobody updates the list.

Build the list this week. Write down each supplier, the exact fields it receives, where it stores them, and who on your team owns the relationship. One shared document beats a perfect system you never finish.

Then rank them by damage. A vendor holding government IDs sits in a different tier than your email newsletter tool, and your attention should follow that gap.

2. Get Breach Notification Terms in Writing

IDScan said it learned of a hack claim around September 1 and posted its notice on September 10. That is a nine day window, and it is exactly the kind of delay that leaves you explaining a breach you only read about in the press.

So negotiate the clock. Ask for notification inside 72 hours of a confirmed incident, a named contact, and the right to receive the forensic summary. Small companies get these terms more often than they expect, because vendors want the logo.

Treat silence as a red flag. A supplier that refuses to commit to a timeline is telling you how the bad day will go, and that answer belongs in your decision.

3. Cut the Data You Hand Over

The cheapest defense is not collecting things. You probably do not need to store a full license image when a pass or fail result would do, and you almost certainly do not need it forever.

Push verification to a yes or no answer wherever the law allows. Set retention windows and actually enforce them. Every field you delete is a field nobody can steal from your supplier later.

This is the same discipline behind good fraud prevention work, because attackers chase whatever sits in storage the longest.

4. Write the Supplier Failure Runbook Now

Decide today what happens when a critical vendor is compromised. Who pauses onboarding, who drafts the customer email, who calls counsel, and who talks to press. Assign names, not roles.

The federal government publishes a solid starting template. The Federal Trade Commission’s data breach response guide for business walks through notification duties and evidence handling, and it costs nothing to adapt.

Also pick a backup provider before you need one. Founders who studied vendor lock in already know that a single supplier for a core function is a single point of failure.

5. Re-Underwrite Your Vendors on a Schedule

A security questionnaire answered at signup tells you almost nothing two years later. Staff changed, architecture changed, and so did the threat. Put a recurring review on the calendar and keep it short enough that you actually do it.

Ask for current certifications, recent penetration test dates, and any incidents since the last review. Then ask what the vendor changed as a result, because the answer separates real programs from paperwork.

Extend the same habit to newer categories. Teams buying AI agent security tooling are adding suppliers with broad system access, and those deserve the tightest review of all.

Vendor Risk Management Questions Founders Ask

Am I liable if my vendor gets breached?

Often yes, at least to your customers and regulators. Your contract may shift some cost to the vendor, but the notification duty and the reputation hit usually stay with you.

How many vendors should a small company review?

Review every supplier that stores personal data, handles payments, or holds production access. For most early teams that is a list of ten to twenty, not hundreds.

What should I tell customers after a supplier breach?

Say what data was involved, when you learned of it, and what you are doing next. Vague reassurance costs more trust than a plain account of the facts.