The company exists to check whether your document is real. It has now confirmed that it is the one that lost the documents of everyone it was checking.

The American company IDScan, which carries out identity document verification for other firms, has confirmed that hackers took driving licences from its cloud. According to the statement on its website, full names and driving licence numbers were stolen, along with identification numbers from other state-issued documents, including passports. On the same page the company states that it holds over 150 million driving licence records.

This is not a suspicion - it is a confirmation, and a late one. The statement came a full week after independent cybersecurity journalist Brian Krebs reported there had been a breach, and after an entire year in which the hackers were inside the system. The previous week IDScan said only that it was "investigating an incident", without confirming that anyone had got in at all.

Krebs came across a dark web page where anyone could search driving licence data on over 150 million people in the US and Canada, including their photographs. He verified its authenticity in the simplest way possible - he found his own record. The database also contained the records of US defence secretary Pete Hegseth and of a security researcher who likewise confirmed his own.

The Louisiana firm's clients range from concert halls to cannabis shops - anywhere somebody scans your document at the door. So this is not a database of people who knowingly signed up somewhere. These are people who went into a club.

The ugliest sentence in the whole statement is the one where IDScan explains why it is notifying people via its website: "although full access to the information required payment". In other words, the thieves were charging money for the whole database. The company does not say how many people are affected, nor whether a ransom was demanded to keep the data unpublished. It did not answer journalists' questions.

The Pentagon confirmed it is aware of the case, and the FBI that it is investigating. That is all there is so far by way of a response from institutions.

There is something here that concerns us too, without any stretching. Scanning ID cards at the door has become normal in our bars and restaurants, hotels, exchange offices and agencies - a photograph of the document goes into somebody's system and stays there. Nobody asks where that server is, who has access, or how long the images are kept. The difference between us and America is not that our databases are safer - the difference is that here nobody will announce it if they are stolen.

Because a driving licence breach cannot be repaired. A password is changed in a minute. An ID number you carry for life.