IDScan.net Hit With Class-Action Lawsuits After 153 Million ID Breach

Identity verification provider IDScan.net is facing a wave of federal litigation following the exposure of approximately 153 million driver's license scans. The breach, which affects millions of citizens across the U.S. and Canada, has triggered an FBI investigation and multiple legal challenges.

Four class-action lawsuits have been filed against the New Orleans-based company in the U.S. District Court for the Eastern District of Louisiana. The legal actions follow the discovery of a massive database offered for sale on the dark web via a service known as 'Nexus.' The leaked data is not limited to driver's licenses; it also includes medical cards, travel documents, and various other government-issued ID cards.

The Path to Discovery

The breach was first brought to light by investigative journalist Brian Krebs. Krebs linked the leaked data specifically to IDScan.net after his own driver's license was used as a sample on 'Exploit,' a Russian cybercrime forum. By tracking the movements of identified victims, Krebs was able to connect the data trove to the identity verification vendor's systems.

Permanent Exposure

This incident is particularly severe because of the nature of the stolen data. Unlike credit card numbers or passwords, which can be canceled and reset within hours, the information contained on a government ID—such as dates of birth, home addresses, physical descriptors, and government ID numbers—is largely permanent.

"The harder problem is that unlike a compromised password, none of those fields can be changed, so every person in this dataset will carry this exposure with them for life," said Seemant Sehgal, founder and CEO of BreachLock. Denis Calderone, CTO at Suzu Labs, echoed this sentiment, noting that while a credit card can be replaced in 24 hours, "you can't get a new face."

Industry Implications

The breach highlights a critical vulnerability in the identity verification industry. Vendors like IDScan.net are entrusted with the most sensitive documents a citizen possesses to help clients verify identities. When these vendors retain such data without sufficient security, they create a single point of failure that can lead to lifelong identity theft risks for millions of people.

What's Next

As the FBI continues its investigation into the source of the leak, the four class-action lawsuits will likely focus on whether IDScan.net maintained reasonable security standards for the data it collected. It remains to be seen if the company will offer credit monitoring or other remediation services to the affected North American citizens, or if further data dumps from the 'Nexus' service will emerge.