Cybersecurity
IDScan faces lawsuits over alleged data breach
Multiple law firms and the FBI examined allegations that identity verification company IDScan exposed data, while lawsuits in Louisiana claimed millions of identity documents were offered for sale online.
- Brian Krebs reported on 1 September that a dark-web service called Nexus advertised access to more than 153 million driver’s licence scans, 10 million ID cards, 3 million travel documents and 579,000 medical cards.
- Krebs said he checked sample records with his own details and with records belonging to other people who had agreed to the test, then linked the leak to IDScan.
- Several lawsuits were filed in Louisiana against IDScan, and Markovits, Stock & DeMarco and Hall Attorneys began investigating possible class-action claims.
- The FBI’s New Orleans office said it was investigating the incident, and the FBI declined to comment further.
- IDScan had not issued a public statement on the allegations and did not reply to BleepingComputer’s requests for comment.
Brian Krebs reported on 1 September that Nexus was advertising access to millions of identity documents, including more than 153 million driver’s licence scans. He said he verified sample records by checking his own details and those of other consenting people, and traced the material to IDScan.
The article said multiple lawsuits had been filed in Louisiana against IDScan. It also said Markovits, Stock & DeMarco and Hall Attorneys had opened investigations into possible class-action litigation, and that the suits accused the company of failing to protect customer information, including data linked to Hertz.
The FBI’s New Orleans office said it was looking into the incident, and Reuters also said it had confirmed that separately. The FBI declined to say more because the matter was still under investigation.
The article said IDScan had not made a public statement and had not answered BleepingComputer’s requests for comment. It also said Nexus was no longer online, though the database remained accessible to cybercriminals.
BleepingComputer said it could not verify documents in the data said to belong to Pete Hegseth and an assistant director of the FBI. The article added that more lawsuits, and possibly multidistrict litigation, could follow.
Named in this story
People
- Brian Krebs
- first reported the data advertisement and checked sample records
- Pete Hegseth
- was said to appear in documents found in the database
Companies
- IDScan
- was accused in lawsuits of failing to protect client information
- Hertz
- was named in the lawsuits as a client of IDScan
Organisations
- Markovits, Stock & DeMarco
- launched investigations into possible class-action litigation
- Hall Attorneys
- launched investigations into possible class-action litigation
Governments and agencies
- FBI’s New Orleans office
- said it was investigating the incident
Products and systems
- Nexus
- was the dark-web service that advertised the data
Places
- Louisiana
- was where the lawsuits were filed and where IDScan is based
How the source tells it
The piece is mostly straight reporting, but it leans on large figures, litigation language and unresolved allegations to create a mildly alarmed register.
- alarm large record counts and the prospect of multiple lawsuits are used to signal severity
- uncertainty repeated tentative wording and explicit notes that key claims were not yet verified keep the central allegation unresolved