IDScan Sued Over Alleged Breach Affecting 153 Million Drivers

Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached the service and offered to sell more than 153 million driver’s licenses.

Brian Krebs reported on September 1 that a dark-web identity-theft service called “Nexus” advertised access to more than 153 million U.S. and Canadian driver’s license scans, 10 million ID cards, 3 million travel documents, and 579,000 medical cards. Krebs said he verified samples by searching for records belonging to himself and other people who had consented to the checks, and traced the database to IDScan.

IDScan provides hardware and software for businesses to scan, authenticate, and extract information from government-issued identity documents. Its systems are used by car rental firms, retailers, gun shops, financial institutions, cannabis dispensaries, and hospitality establishments across the U.S.

IDScan has not published a statement about the allegations and did not respond to BleepingComputer’s requests for comment. It remains unclear whether IDScan’s systems were compromised or how many people were affected. Reuters independently confirmed that the FBI’s New Orleans office is investigating, although the agency has not issued an official statement.

The lawsuits, filed in Louisiana, allege that IDScan failed to protect client information, including data connected to Hertz. The Nexus service is no longer online, but cybercriminals reportedly still have access to the database.