IDScan Faces Lawsuits Over Alleged Breach Involving 153 Million Driver’s License Scans
Summary
Lawsuits followed reports that the dark-web service Nexus offered more than 153 million driver’s license scans and other identity documents traced to IDScan. A reported FBI investigation is underway, but the breach and number of affected people remain unconfirmed.
Key points
- Nexus reportedly advertised more than 153 million U.S. and Canadian driver’s license scans, along with millions of other identity documents.
- Brian Krebs reportedly verified sample records and traced them to IDScan; the article says cybercriminals still have access to the database.
- It remains unclear whether IDScan’s systems were compromised or how many people were affected.
- Multiple lawsuits have been filed in Louisiana, alleging IDScan failed to protect information belonging to its clients, including Hertz.
- Law firms are investigating potential class actions; one firm said IDScan began notifying some business customers around September 1.
- The FBI’s New Orleans office is reportedly investigating, but the agency had not issued an official statement as of publication.
- IDScan had not publicly commented or responded to BleepingComputer’s requests.
Article Details
- Victim Organization
- IDScan
- Incident Type
- Alleged data breach involving identity-document scans advertised for sale on a dark-web service
- Data Types Exposed
- Driver's license scans
- ID cards
- Travel documents
- Medical cards
- Affected Records
- The Nexus service advertised access to more than 153 million U.S. and Canadian driver’s license scans, 10 million ID cards, 3 million travel documents, and 579,000 medical cards. These are advertised figures; the number of affected people and whether IDScan's systems were compromised remain unclear.
- Operational Impact
- IDScan's systems were not confirmed to have been compromised. The article reports lawsuits and investigations, and says Markovits, Stock & DeMarco stated that IDScan began notifying some business customers around September 1.
- Ransom Or Extortion
- Nexus advertised access to the records for sale. The article says cybercriminals still had access to the database, but reports no ransom demand.
- Claim Status
- alleged