IDScan Faces Lawsuits After Data Breach Exposes 153 Million Driver's Licenses

IDScan, a company specializing in identity verification technology, is currently embroiled in multiple lawsuits following an alleged data breach that has compromised the personal information of over 153 million individuals. The breach reportedly involved hackers who offered to sell scans of U.S. and Canadian driver's licenses, as well as other forms of identification, on the dark web. Cybersecurity expert Brian Krebs first reported the incident, revealing that a dark-web service named "Nexus" was advertising access to this vast trove of personal data.

Krebs verified the authenticity of the leaked data by checking his own records and those of others who had consented to the verification process. This led him to trace the breach back to IDScan, which provides businesses with hardware and software solutions to scan and authenticate government-issued identity documents. The company's systems are widely used across various sectors, including car rentals, retail, and financial services.

As of now, IDScan has not publicly commented on the allegations or responded to inquiries from BleepingComputer. The extent of the breach and whether IDScan's systems were directly compromised remain unclear. However, the FBI's New Orleans office has initiated an investigation into the matter, which has been independently confirmed by Reuters.

The lawsuits, filed in Louisiana where IDScan is headquartered, allege that the company failed to adequately protect sensitive information belonging to its clients, including major corporations like Hertz. Legal representatives from the law firms involved in the lawsuits are actively seeking potential claimants for a possible class-action case, indicating that individuals whose IDs were scanned through IDScan's systems may be at risk.

Given the scale of the breach, it is anticipated that additional lawsuits could emerge, potentially leading to consolidated cases in multidistrict litigation. Furthermore, state attorneys general and federal regulators may also pursue separate investigations or enforcement actions, similar to those seen in past high-profile data breaches involving companies like 23andMe and Equifax. The incident underscores the ongoing vulnerabilities in data security and the challenges faced by organizations in safeguarding personal information.