SEVERAL class-action lawsuits have been filed in the US District Court for the Eastern District of Louisiana against IDScan[.]net, the driver’s licence verification and ID‑verification provider at the centre of an alleged mega-breach. The suits seek damages and request improvements to the company’s internal security posture. The FBI says it is investigating the incident, which first came to light after reporting from journalist Brian Krebs.
The disclosures centre on a claim from a Russian cybercrime forum’s service “Nexus” that it possessed over 153 million driver’s licences, alongside more than 10 million ID cards and other documents. Krebs’ reporting linked the data to IDScan[.]net, based in New Orleans, which supplies B2B verification services to major names including Hertz, FedEx and numerous cannabis dispensaries across the United States.
Industry observers quoted in the piece describe the scale of the data held by data brokers and the sensitivity of such personal information, with calls for stronger protections or regulatory frameworks akin to HIPAA for large datasets.
The article notes several avenues for potential victims to pursue further action, including identifying where and when their data may have been scanned, and which provider was used. It also advises keeping records of any breach inquiries and responses, and to treat unredacted breach-check links with suspicion. IDScan[.]net has reportedly said it is investigating the incident.