Emerging ThreatsData Breaches

IDScan Faces Lawsuits Over Alleged Driver's License Data Breach

Analyst 207||Source: InfoSecMag
Courthouse setting with files, chair, and blurred cityscape through window.

“When you look at data brokers and the sheer amount of information they collect, purchase, acquire, aggregate and store over time, it’s absolutely staggering.” — John Strand, owner, Black Hills Information Security

Class-action lawsuits filed in the US District Court for the Eastern District of Louisiana

At least four class-action lawsuits have been filed against IDScan.net in the US District Court for the Eastern District of Louisiana, according to reporting compiled after last week’s disclosures. The plaintiffs seek damages and want the company, which provides ID verification and fraud prevention services, to improve its internal security posture.

Those filings arrive as multiple law firms have moved to investigate potential victims and claims. At least two additional large firms — Hall Attorneys and Markovits, Stock & DeMarco — are publicly advertising investigations into possible claims. A note on Markovits, Stock & DeMarco’s website reads: “If you rented a vehicle, visited a cannabis dispensary, or otherwise had your driver’s license or other identification document scanned or verified through IDScan.net’s systems, you may be entitled to compensation and other legal remedies.”

The Nexus listing and the claimed dataset

A service dubbed “Nexus” on a Russian cybercrime forum claimed to have “over 153 million driver’s licenses for mainly American as well as Canadian drivers,” along with “over 10 million ID cards, travel documents, medical cards and more,” according to published reporting. The Nexus posting was taken down shortly after journalist Brian Krebs published his story.

Krebs reported that he tracked activity from his own and other identified victims’ movements to link the data to New Orleans-based IDScan.net. The alleged scale of the dataset — if accurate — would place driver’s-license images and parsed ID fields at the center of the controversy.

IDScan.net’s customers named in reporting: Hertz, FedEx, and cannabis dispensaries

Reporting identifies IDScan.net as a B2B ID verification provider used by a range of large businesses and many smaller locations. Named customers include car rental company Hertz and FedEx, and the company provides services to “hundreds of cannabis dispensaries across the US,” the reporting states. Those customer connections are central to the lawsuits’ claims and to questions about what records were collected and retained.

Guidance from Hall Attorneys and Markovits, Stock & DeMarco for potential victims

Hall Attorneys published a set of specific steps it urges individuals to take if they believe their ID was scanned or uploaded through IDScan.net or a similar provider. The firm’s guidance includes:

  • Identify the business, location, approximate date, and reason your ID was scanned or uploaded
  • Ask whether the business used IDScan.net, VeriScan, DIVE, or another ID-verification provider
  • Ask whether front-and-back images, infrared or ultraviolet captures, a selfie, or parsed ID fields were retained and whether your record is within any incident review
  • Keep the request and response. Don’t send an unredacted ID image, Social Security number, or account password in an initial inquiry
  • Treat unsolicited breach-check links as suspicious

Markovits, Stock & DeMarco’s public notice reiterates the range of places where an ID may have been scanned and frames that as the basis for potential legal remedies.

FBI investigation and IDScan.net’s response

The FBI said last week that it is investigating the incident; the probe began after the initial reporting by Brian Krebs. IDScan.net has “reportedly said it is investigating the incident,” according to the same reporting.

Security professionals quoted in the reporting framed the situation as part of a larger question about how large aggregated personal datasets are protected. John Strand of Black Hills Information Security said, “I do think we need to start treating this type of data with protections similar to what we provide for protected health information. Maybe that means bringing some of it under HIPAA-like protections or creating a regulatory framework that treats large collections of personal data with the same seriousness.”

The combination of multiple class-action suits, ongoing law-firm solicitations to potential victims, a public posting claiming a dataset of “over 153 million driver’s licenses,” and an FBI inquiry has placed IDScan.net at the intersection of litigation, investigation, and public scrutiny. Whether courts or investigators will confirm the full scope and provenance of the alleged dataset remains to be determined; in the meantime, consumer-facing law firms are advising individuals to document where and when their IDs were scanned and to seek corroboration about retention practices.

Original story

Data BreachEmerging ThreatsIdentity TheftInformation SecurityClass Action LawsuitData BrokersUS District CourtID VerificationLouisianaIdscan.net
Related Intelligence

Continue Reading

Person sitting at laptop with concerned expression, surrounded by papers and financial screens.

JSCeal Malware Exploits Stolen Cookies to Bypass Google Authentication

Meet JSCeal, a sneaky malware that's using stolen cookies to outsmart Google's authentication - putting retail traders and cryptocurrency users in its crosshairs. It's spread through clever malvertising tactics, including fake ads on Facebook and Google that lead victims to counterfeit trading sites.

Analyst 207
Security researcher pauses at desk with laptop and notebooks.

Security Researcher Exposes CrowdStrike Zero-Day Flaw

A security researcher known as Nightmare Eclipse has uncovered a zero-day flaw in CrowdStrike's Falcon Sensor, dubbed FalconFlank, which can be exploited to escalate privileges by manipulating Office malicious macros remediation. The researcher has even shared a public proof-of-concept on GitHub, highlighting the vulnerability's potential impact.

Analyst 207
IT professionals in a server room examine a laptop with concern.

N-able Rushes Patch for Max-Severity RCE Flaw Under Attack

N-able has urgently released a hotfix to tackle a critical remote code execution flaw in its N-central platform, warning customers to patch immediately to protect their environment from potential attacks. With nearly 1,500 N-central servers exposed online, mainly in the US and Europe, swift action is crucial to prevent exploitation.

Analyst 207
Laptop screen shows an inbox with a suspicious email from a bank hovering under the cursor.

Phishers Exploit Invisible Unicode Characters to Evade Email Filters

Microsoft researchers uncovered a massive phishing campaign that used sneaky invisible Unicode characters to slip past email filters, peaking at a staggering 2.37 million messages per day in late February. This clever tactic, dubbed "ASCII smuggling," allowed scammers to hide finance-themed lures in plain sight.

Analyst 207