Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached the service and offered to sell more than 153 million driver’s licenses.
Several law firms, incl Markovits, Stock & DeMarcoand Lawyers in courthave also begun investigations into potential class action lawsuits related to the reported IDScan security incident.
Brian Krebs originally reported on September 1 that a dark web identity theft service called “Nexus” advertised access to more than 153 million scans of US and Canadian driver’s licenses, 10 million ID cards, 3 million travel documents and 579,000 medical records.
Krebs verified the samples by searching the database for his own records and those of others who agreed to the checks, and traced the leak to IDScan.
IDScan is an identity verification technology company that provides hardware and software solutions for businesses to scan, authenticate and extract information from government-issued identification documents.
Its systems are used across the US at car rental companies, retailers, gun shops, financial institutions, cannabis dispensaries and hospitality establishments.
The company has not released any statements regarding these allegations and did not respond to BleepingComputer’s requests for comment.
It is currently unclear whether IDScan’s systems were compromised or the number of individuals affected.
Krebs also reported that the FBI’s New Orleans office has opened an investigation into the incident, which Reuters also confirmed regardless.
The agency also confirmed to BleepingComputer that it is investigating the incident. However, the FBI declined any further comment due to the ongoing nature of the investigation.
The illegal Nexus service is no longer online. However, cybercriminals still have access to the database.
BleepingComputer has learned that the service includes documents belonging to US Defense Secretary Pete Hegseth and an FBI assistant director, but we were unable to verify the information.
The lawsuits were filed in Louisiana, where IDScan is based, and allege that IDScan failed to protect information from its customers, such as global car rental company Hertz.
According to Markovits, Stock & DeMarco, IDScan began notifying some business customers around September 1.
The law firm says people whose ID numbers have been scanned through companies using IDScan’s systems may be affected and is seeking potential plaintiffs for a possible class-action lawsuit.
Given the potential scale of the incident, additional lawsuits may be filed, including potential class actions, and related cases could eventually be consolidated into litigation in different areas.
State attorneys general and federal regulators could launch separate investigations or enforcement actions, as happened with data exposures on a similar scale in the recent past, including for 23andMe, Marriott and Equifax.
Update (Sept. 4, 2:50 p.m. EST): The article has been edited to include the FBI’s confirmation that the incident is under investigation.
Generic prevention scores can hide what happens after initial access. Once attackers use valid credentials, prevention plummets.
The 2026 Blue Report measures security techniques by techniques in 338 million simulations run in customer production environments.
