Identity‑Verification Firm IDScan Hit with Multiple Lawsuits Over Alleged 153‑Million Driver’s License Breach

Identity‑verification company IDScan is facing a series of lawsuits after a reported cyber intrusion allegedly exposed the driver’s license information of more than 153 million individuals. Plaintiffs allege that hackers broke into the firm’s systems, extracted the data and then attempted to sell the records on underground markets.

The alleged breach came to light after security researchers observed a post on a hacker forum offering a bulk list of driver’s licenses linked to IDScan’s services. The post claimed the data set contained personal identifiers, including names, dates of birth and license numbers, for a volume that exceeds the total number of licensed drivers in the United States. The story was first reported by BleepingComputer, which cited the online advertisement as evidence of the compromise.

IDScan provides identity‑verification solutions to financial institutions, retailers and other businesses that need to confirm a customer’s identity in real time. As part of that service, the company stores scanned copies of government‑issued IDs, such as driver’s licenses, along with associated biometric data. While the industry routinely handles large volumes of sensitive personal information, the scale of the alleged exposure—potentially encompassing every licensed driver in the country—has raised alarms about the adequacy of existing security safeguards.

Legal filings describe the action as a class‑action suit on behalf of all affected individuals, citing violations of state data‑protection statutes and alleging negligence in protecting personal data. Plaintiffs are seeking compensatory damages, statutory penalties and injunctive relief to compel IDScan to improve its security practices. The suits also reference potential exposure to identity‑theft fraud, which could result in long‑term financial harm for victims.

The case underscores growing concerns about the security of third‑party data aggregators that hold vast repositories of personal information. Regulators have increasingly focused on the responsibilities of such firms, and the outcome of these lawsuits could influence future oversight and industry standards. IDScan has not publicly commented on the allegations, and the litigation is expected to proceed through the courts while investigators continue to examine the breach’s origins and scope.