IDScan Hit With Lawsuits Over Breach of 153 Million Driver's Licenses

The American company IDScan, which specializes in document authentication, has been hit with several lawsuits at once. The trigger was an alleged breach of its service: according to the available information, attackers gained access to more than 153 million scans of driver's licenses from the U.S. and Canada.

The first to report the incident, on September 1, was journalist Brian Krebs. According to him, a shadowy identity-theft service called “Nexus” was advertising access to 153 million driver's licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical records. Krebs verified a sample for authenticity by locating his own records in the database, along with the data of people who had consented to such a check, and traced the trail back to IDScan.

IDScan supplies businesses with hardware and software solutions for scanning, authenticating, and extracting information from government-issued IDs. Its systems are used by car-rental companies, retail chains, gun stores, financial institutions, cannabis dispensaries, and hospitality venues across the country.

No official comment yet

The company itself has stayed silent: it has issued no statements regarding the accusations and has not responded to journalists' inquiries. It remains unclear whether its systems were actually compromised and how many people were affected. What is known is that around September 1, IDScan began notifying some of its corporate clients.

Krebs also reported that the FBI's New Orleans field office had opened an investigation; this was independently confirmed by the Reuters news agency. The bureau has not yet provided any official comment. The Nexus service itself is no longer accessible, but the database, according to the journalist, still remains in the criminals' hands.

Legal outlook

The lawsuits were filed in Louisiana, where IDScan is registered. They allege that the company failed to protect data obtained from its clients, among whom the international rental operator Hertz has been named. The law firms Markovits, Stock & DeMarco and Hall Attorneys have already launched their own investigations and are looking for potential participants for class-action suits — the affected parties could include anyone whose documents were scanned through IDScan's systems.

Given the potential scale of the incident, the number of lawsuits will grow, and individual cases may be consolidated into a single proceeding. Independent investigations by state attorneys general and federal regulators are also possible — as has already happened after breaches of similar magnitude at 23andMe, Marriott, and Equifax.

Source: Bleeping Computer