Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached its systems and offered more than 153 million U.S. and Canadian driver’s license scans for sale online. Several law firms are also investigating the incident for potential class-action lawsuits.
The incident was first reported by cybersecurity journalist Brian Krebs on September 1, after a dark-web identity theft service called Nexus advertised access to more than 153 million driver’s licenses, 10 million ID cards, 3 million travel documents and 579,000 medical cards. Krebs verified some of the records by checking his own information and records belonging to people who had agreed to the checks, eventually linking the data to IDScan.
IDScan provides hardware and software used by businesses to scan, authenticate and extract information from government-issued identification documents. Its technology is used by businesses across the United States, including car rental companies, retailers, financial institutions and hospitality businesses.
However, it has not yet been confirmed that IDScan itself was breached, and the full number of people affected remains unclear. IDScan has not published a public statement about the allegations and did not respond to BleepingComputer’s requests for comment.
The FBI’s New Orleans office is also investigating the incident, with the agency confirming that it is looking into the matter but declining to provide further details because the investigation is ongoing. Reuters has independently reported the FBI investigation.
The Nexus service has since disappeared from the dark web, although the disappearance does not mean the stolen data is no longer in the hands of cybercriminals. Reports also found records allegedly belonging to high-profile individuals, although some of those claims could not be independently verified.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The lawsuits were filed in Louisiana, where IDScan is based, and accuse the company of failing to adequately protect information collected through its business customers, including global car rental company Hertz. IDScan has reportedly begun notifying some business customers about the incident.
