IDScan Data Breach: A State Filing Counts 13 Million People, Not 153 Million — an 18th Suit Was Filed in New Orleans on October 8, Eight Cases Show Stay Entries, and There Is Still No Settlement or Claim Form

For five weeks the only big number attached to the IDScan data breach came from criminals: a dark-web service that claimed to sell more than 153 million U.S. and Canadian driver’s license records, plus more than 10 million ID-card records, more than 3 million travel documents and at least 579,000 medical-card records. IDScan.net, the New Orleans-area company whose VeriScan cloud platform businesses use to scan IDs, has never confirmed that figure, and its public notice still gives no count.

A state filing now does. The Oregon Department of Justice’s consumer data breach list, which we read on October 17, 2026, has this entry for IDScan.net: reported date 09/18/2026; dates of breach 4/1/2026 – 9/2/2026; date of discovery 9/1/2026; date notice sent 9/4/2026; number affected 13000000 — that is, 13,000,000 people. The security site eSecurity Planet reported on September 28 that a Texas Attorney General listing dated September 21 also shows “13 million people in total,” with one Texas resident. The Oregon page does not say whether its column means people nationwide or Oregonians only; the Texas listing, as reported, calls the same figure a total.

Two cautions. First, 13 million and 153 million measure different things. As eSecurity Planet put it, “The two figures describe different things and should not be treated as interchangeable”: one is the count of people IDScan reported to regulators, the other is the number of records the sellers advertised, which can include duplicates and older scans. Neither number tells you whether you are in the data. Second, the dates do not match exactly: Oregon lists the breach as starting April 1, 2026, while IDScan’s notice, updated September 29, says an unauthorized third party had access to part of its cloud “between April 4, 2026, and September 2, 2026.” Neither source explains the difference.

You were not IDScan’s customer. The businesses that scanned your license at a rental counter, a dispensary, a bar or a casino were. IDScan’s notice says the event “was limited to the VeriScan platform” and that the information involved “could include a combination of the full name, contact information, date of birth, driver’s license, passport, and/or other government-issued identification numbers,” depending on what each business chose to store.

How do you tell if you have a data breach? For this one, a letter may never come. The date Oregon lists for notice — 9/4/2026 — is the day IDScan posted its notice on its website, and BleepingComputer reported that the page was “configured with a noindex directive” that kept it out of search engines. IDScan has not published a lookup tool, and it has not said it will mail individual letters. So the practical test is the one the Federal Trade Commission gives for identity theft in general: “Charges for things you didn’t buy could be a sign of identity theft,” and “Accounts in your name that you don’t recognize could be a sign of identity theft” — so check your bills, your bank statements and your free credit reports. If you showed a license at a business that used VeriScan, assume you may be in the 13 million and act accordingly.

What is identity theft in cybersecurity? The FTC’s definition is short: “Identity theft is when someone uses your personal or financial information without your permission.” A breach like this one is the first step — the theft of the information. The identity theft is what someone does with it later, such as opening an account in your name. One of the newer complaints shows what plaintiffs say that looks like: according to WWL Louisiana, it describes an Indiana resident who received a $39 charge that the bank blocked and an alert about a car purchase the plaintiff says they never made. Those are allegations in a lawsuit, not findings.

When we last reported on September 30, there were 17 IDScan suits in the Eastern District of Louisiana, at least 12 of them before Chief Judge Wendy B. Vitter. As of October 17, the federal docket service CourtListener lists at least 18 in that court, from Bunch v. IDscan.net, Inc. on September 2 to McGaha v. IDscan.net, Inc. (No. 2:26-cv-02336) on October 8, 2026. On October 15 the McGaha docket shows an “Order Transferring Case” and a waiver of service; the entry text was not available to us, so we cannot say which judge it went to. WWL Louisiana reported on October 12 that “At least 18 federal lawsuits have been filed against IDScan” and that the number “has nearly doubled” in a little over a month. Two related suits elsewhere name IDScan together with Hertz or the dispensary chain Planet 13, and Pugh v. IDscan.net, Inc. in New Orleans names both.

The other new development is a cluster of docket entries labeled “Stay” in eight of the Louisiana cases: Rodriguez, Greenbaum and Wagner on October 6; Bunch, Fisher and Sullivan on October 7; Pugh on October 8; and Carter on October 9. The text behind those entries was not available to us, so we cannot tell whether they are requests or court orders, what exactly is paused, or for how long. Answers had been due on September 29 in Bunch and October 6 in Greenbaum, according to the proofs of service.

The motion to consolidate the cases, refiled in Rioux v. IDscan.net, Inc. and marked deficient by the clerk, listed a submission date of October 13, 2026. In the docket entries we could see for October 7 through 15 — mostly out-of-state lawyers asking to appear in Bunch, Sakalinskas and Chambers — there was no consolidation order. No class has been certified, and no court has found IDScan liable for anything; every claim in these complaints is an allegation.

For you, that means there is nothing to file. There is no settlement, no claim form and no deadline. Law firms advertising about IDScan are looking for clients, not paying class members. WWL quoted a Tulane law professor who cautioned that even if plaintiffs win money, “the amounts awarded could be relatively small.” For what other data breach settlements have paid, see our data breach settlement calculator; any dollar figure for IDScan today would be a guess.

• Enroll in IDScan’s free credit monitoring. Call 1-833-516-2980, Monday through Friday, 8 a.m. to 8 p.m. Eastern, excluding holidays. The notice does not name the monitoring company or an enrollment deadline.
• Freeze your credit. The FTC says a freeze means “nobody can open a new credit account” while it is in place, and that freezes are “free to place and lift.” Contact all three bureaus: TransUnion 1-800-680-7289, Experian 1-888-397-3742, Equifax 1-888-298-0045. If you would rather not freeze, a free one-year fraud alert placed with one bureau is passed on to the other two.
• Report misuse. Use IdentityTheft.gov or 1-877-438-4338; IDScan’s notice reminds U.S. residents that they have the right to file a police report.
• Watch your statements and be careful with anyone who contacts you about this breach.

How bad is it if your SSN gets leaked? That is a different problem from this breach. IDScan’s notice does not list Social Security numbers among the data involved — it names names, contact details, birth dates and ID numbers. If your SSN was exposed in a different incident, this page and IDScan’s monitoring offer won’t help with it; check that company’s own notice and report any misuse at IdentityTheft.gov.

How long does it take to investigate a data breach? For IDScan, there is no end date. The company says it learned of the problem on or around September 1, 2026 and that its investigation “is currently ongoing.” Canada’s Privacy Commissioner opened a formal investigation on September 21, 2026 into IDScan’s security safeguards and “the adequacy of its notifications to affected individuals,” and said it “is not in a position to provide further details at this time.” The FBI has also said it is investigating, BleepingComputer reported earlier. None of them has given a timetable.

IDScan’s notice is genuine and is posted on IDScan.net’s notice page; on October 17 it still read “Updated September 29. Initially posted September 4, 2026.” Its only contact points are the call center at 1-833-516-2980 and the mailing address 8814 Veterans Memorial Blvd, Suite 3-124, Metairie, LA 70003. Because there is no settlement, there is no settlement administrator, no settlement website and no payment. A text, email or call offering “IDScan settlement money,” charging a fee, or asking you to type your license number into a site to check whether you are among the 13 million is not from IDScan or from the court. If a rental company or dispensary writes to you about this incident, check the letter against that business’s own website before you call any number in it.

The record now has an official scale — 13,000,000 people, as reported to the Oregon Department of Justice — and at least 18 lawsuits in one federal court, most before one judge and several apparently paused. That is enough for lawyers to fight over leadership and consolidation, but it is a long way from money: nothing in the IDScan dockets we could read points to a settlement. The next things to watch are a ruling on the consolidation motion that was up for submission on October 13, the details of the stays, and any change to IDScan’s notice. Our earlier report has the background on how the breach was found and which businesses used VeriScan. This article reflects the record as of October 17, 2026.