Multiple lawsuits have been filed against IDScan, an identity verification technology company, following claims by a dark-web service that it possesses and is selling a database containing scans of over 153 million driver's licenses and other identity documents. The lawsuits, filed in Louisiana where IDScan is headquartered, allege that the company failed to adequately protect client data.
The claims originated from a dark-web identity-theft service called Nexus, which advertised access to a database containing more than 153 million U.S. and Canadian driver's license scans, 10 million ID cards, 3 million travel documents, and 579,000 medical cards. A journalist independently verified samples from the database, confirming the presence of personal records, and subsequently traced the leak to IDScan.
IDScan provides hardware and software solutions that enable businesses to scan, authenticate, and extract information from government-issued identity documents. Its technology is utilized across various sectors in the U.S., including car rental agencies, retailers, gun shops, financial institutions, cannabis dispensaries, and hospitality establishments.
As of early September, IDScan has not issued any public statements regarding the allegations and has not responded to inquiries for comment. It remains unconfirmed by the company whether its systems were compromised or the precise number of individuals affected.
Law firms, including Markovits, Stock & DeMarco, and Hall Attorneys, have initiated investigations into potential class-action litigation. Markovits, Stock & DeMarco stated that IDScan began notifying some business customers around September 1st. These firms are seeking potential claimants for a class-action case, noting that individuals whose IDs were scanned through businesses using IDScan's systems may be impacted.
The FBI's New Orleans office has reportedly launched an investigation into the incident, a detail independently corroborated by a major news wire service. However, the agency has not yet released an official statement or responded to requests for confirmation.
While the illegal service Nexus is no longer online, the compromised database is believed to remain accessible to cybercriminals. The potential scale of the incident suggests that additional lawsuits, including further class actions, could be filed, possibly leading to consolidation into multidistrict litigation. State attorneys general and federal regulators may also initiate separate investigations or enforcement actions, mirroring responses to similarly large-scale data exposures in the past.
