Almeida Law Group is investigating a data breach at IDScan.net. The breach occurred on April 1st, 2026 – September 2nd, 2026 and was discovered on September 1st, 2026. If you were affected, contact Almeida Law Group.
About IDScan.net
IDScan.net is a New Orleans, Louisiana-based developer of AI-powered identity verification and ID scanning technologies, founded in 2003. The company sells its VeriScan platform to businesses for ID scanning, document authentication, age verification, and access management across sectors including car rentals, retail, financial services, hospitality, cannabis dispensaries, and gaming. Clients have included Hertz, Target, FedEx, AMC Theaters, and Borgata Hotel Casino & Spa, and the company’s technology has received TSA approval. Because IDScan.net’s core business involves collecting and storing scanned government-issued identity documents from individuals across many industries, a breach of its systems carries significant identity theft risks for a large number of people.
What Happened?
IDScan.net was listed in a Texas Attorney General data security breach report published on September 21st, 2026. The company confirmed that an unauthorized third party accessed its cloud environment and may have accessed and copied customer information stored within accounts on the IDScan.net cloud. The data involved includes full names, driver’s license numbers, other government-issued ID numbers such as passport and state ID card numbers, and dates of birth. IDScan.net reported 13,000,000 persons affected to the Texas Attorney General. The company posted notice of the breach on its website and stated it found no evidence of ongoing unauthorized access. Records entered before September 1st, 2026 were affected. IDScan.net offered free credit monitoring to affected individuals.
The breach came to wider public attention on September 1st, 2026, when cybersecurity journalist Brian Krebs reported that a dark-web marketplace called “Nexus” was selling access to a large trove of scanned identity documents. Krebs verified that the data was real. IDScan.net formally confirmed the breach on approximately September 10th, 2026. The company has not confirmed the total scale of the Nexus listing — the marketplace advertised over 153 million U.S. and Canadian driver’s licenses, a figure that has not been verified by IDScan.net or any regulator. The Nexus service was reportedly shut down shortly after the Krebs report was published, and the FBI’s New Orleans field office opened a formal investigation into the incident. By September 4th, 2026, nine putative class-action complaints had been filed against IDScan.net in the U.S. District Court for the Eastern District of Louisiana, with plaintiffs from California, Florida, Georgia, and Louisiana alleging the company failed to adequately protect personal information. Additional law firms are also reported to be investigating potential claims.
Key Facts at a Glance
- Company or Organization: IDScan.net
- Industry: Identity Verification / ID Scanning Technology
- Location: New Orleans, Louisiana
- Incident type: Unauthorized access to cloud environment
- Date of breach: April 1st, 2026 – September 2nd, 2026
- Date breach discovered: September 1st, 2026
- Date of consumer notification: September 21st, 2026
- Total persons affected: 13,000,000
- Identity theft protection offered: Free credit monitoring
- Litigation status: Nine putative class-action complaints filed September 2nd–4th, 2026, in the U.S. District Court for the Eastern District of Louisiana (case numbers 2:26-cv-01929 through 2:26-cv-01956); FBI investigation opened by New Orleans field office
- Source: Texas Attorney General data security breach report; Krebs on Security; Cybersecurity News; Help Net Security; eSecurity Planet; Zyphe
What Should You Do?
If you received a notice from IDScan.net, enroll in the free credit monitoring it offered as soon as possible and note any enrollment deadline communicated in your notice. Beyond that, consider placing a fraud alert or a credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to make it harder for someone to open new accounts in your name. Because driver’s license numbers, government-issued ID numbers, and dates of birth were exposed, you should monitor your existing financial accounts closely for unfamiliar activity and review your credit reports regularly at AnnualCreditReport.com. If you spot signs of fraud or identity theft, report them at IdentityTheft.gov, which provides step-by-step recovery guidance.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
