IDScan Data Breach: 17 Lawsuits in Four Weeks, Most Now Before One Judge, and No Settlement — IDScan Says an Intruder Was in Its VeriScan Cloud From April 4 to September 2, 2026, but Has Not Said How Many People Are Affected

IDScan.net sells ID scanners and a cloud platform called VeriScan that businesses use to read and check driver's licenses, passports and other IDs at the door or the counter. On September 4, 2026 it put a “Notification of Data Security Incident” on its website; the version online now is marked “Updated September 29. Initially posted September 4, 2026.” It says that on or around September 1 the company “received information indicating that certain data may have been accessed without authorization,” and that its investigation, which is still going on, found that “an unauthorized third party gained access to a portion of our cloud environment between April 4, 2026, and September 2, 2026.” According to the notice, the event “was limited to the VeriScan platform”; no other IDScan product or service has been identified as involved.

What may have been taken, in IDScan's words: “a combination of the full name, contact information, date of birth, driver’s license, passport, and/or other government-issued identification numbers.” Not every item applies to every person, because what was stored depended on “how a particular customer organization used the VeriScan platform and the information it chose to collect, process, or store.” IDScan says it is “not aware of any misuse of personal information as a result of this event” but that the information “could give rise to a risk of fraud or identity theft.”

Two things are missing from the notice: a count of the people affected, and any mention of pictures of the IDs themselves. Both come from outside reporting. On September 1 the security news site KrebsOnSecurity reported that a new dark-web identity-theft service was advertising more than 153 million U.S. and Canadian driver's license scans — plus more than 10 million ID cards, more than three million travel documents and at least 579,000 medical cards — and traced samples back to IDScan. The people selling it claimed they had been “continuously exfiltrating new data for over a year.” Those numbers are the sellers' claims, not IDScan's; KrebsOnSecurity, which searched the service, wrote that the sellers were “likely not exaggerating” the 153 million figure. BleepingComputer wrote on September 10 that the breach “reportedly also allowed threat actors to steal scans of driver's licenses,” that the service went offline after the first report while the criminals “likely still have access to the database,” and that several people have since claimed to be selling the whole database — sales it could not confirm. The FBI's New Orleans field office opened an investigation, which the FBI confirmed to BleepingComputer; IDScan says it is cooperating with law enforcement.

You were not IDScan's customer; the businesses that scanned your license were — the notice calls them “customer organizations.” BleepingComputer lists them as “car rental companies, retailers, financial institutions, cannabis dispensaries, gun shops, and hospitality businesses”; TechCrunch describes customers “from entertainment venues to cannabis dispensaries.” IDScan's own site sells age checks to “keep alcohol, tobacco, and cannabis products out of the hands of minors.” According to KrebsOnSecurity, IDScan says it checks IDs for more than 1,000 marijuana dispensaries in 19 states and that its systems perform more than 21 million verifications a month at more than 20,000 locations. Several people KrebsOnSecurity found in the stolen set had handed their licenses to a Hertz rental counter, and one had shown ID at a Las Vegas cannabis dispensary. The first lawsuit alleges that its plaintiff's information reached IDScan through a Hertz car rental, and a later suit names Hertz and the dispensary chain Planet 13 as co-defendants. A brand on IDScan's client list is not proof that its customers are in the data, though: the “trust” page named Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment, and a Caesars spokesperson told KrebsOnSecurity that Caesars has not used VeriScan since February 2025 and had no active VeriScan account at the time of the incident.

The dates need care. The April 4 to September 2, 2026 window in IDScan's notice describes when the intruder was inside its cloud, not when your ID was scanned. The reporter's own license, which KrebsOnSecurity found in the data, carried a timestamp from June 2025, about ten months before that window opened — so an ID scanned in 2025 can be in the data if it was still stored. The notice does not say how long VeriScan keeps scans.

How many people? IDScan has not said. Its breach report to the Texas Attorney General, published there on September 21, 2026, lists the information as name, driver's license number, government-issued ID number and date of birth, gives the method of notice as “Posted at company website or special website”, and puts the number of affected Texans at 1 — a field the Attorney General's page says “may change after a report is listed.” The California Attorney General's breach list, which includes notices posted through September 29, 2026, had no IDScan entry when we checked on September 30. Because the Texas report names website posting, not mail, as the way people are told, do not wait for a letter from IDScan before you act. IDScan has started notifying some of its business customers, according to a law firm quoted by BleepingComputer. The same notice covers Canada; it has a French version and lists Canadian credit bureaus.

The first suit, Bunch v. IDscan.net, Inc., No. 2:26-cv-01929, was filed on September 2, 2026 in the United States District Court for the Eastern District of Louisiana — IDScan's home court; the complaint describes IDScan as a Louisiana corporation based in New Orleans — and assigned to Chief Judge Wendy B. Vitter. It is a proposed class action on behalf of “all persons in the United States whose PII was exposed in Defendant IDScan’s 2026 Data Breach,” with a California subclass, and it claims negligence, breach of implied contract and breach of a third-party-beneficiary contract — the contract between Hertz and IDScan. It asks for damages and for an order making IDScan strengthen its security, submit to annual audits and “immediately provide adequate credit monitoring” to class members. These are allegations; no court has found IDScan liable for anything.

By September 30 the federal docket services CourtListener and Justia listed 17 suits against IDscan.net, Inc. in that court, filed between September 2 and September 28: four on the first day, one on September 3, four on September 4, one on September 8, two on September 9, one on September 10, one each on September 23 and 24, and two on September 28. At least 12 of them are now assigned to Chief Judge Vitter; in Wagner v. IDscan.net, Inc., for example, the originally assigned judge signed an order on September 9 transferring the case to her. Five were still listed before other judges of the district on September 30. Two more suits naming IDScan were filed elsewhere: Hasenzahl v. Hertz Corporation (No. 5:26-cv-05735) on September 7, and Djordjevic v. Planet 13 Holdings Inc. in the District of Nevada on September 23.

On September 16 two plaintiffs asked the court to consolidate the cases, but filed the motion in the Bunch docket; on September 18 the clerk noted it had gone into “the prospective master case instead of the prospective member cases” and had to be refiled. It was refiled in Rioux v. IDscan.net, Inc. on September 23, where the clerk marked it deficient; the docket lists a submission date of October 13, 2026. As of September 30 we found no consolidation order, and we could not confirm whether anyone has asked the Judicial Panel on Multidistrict Litigation to gather the cases from different states in one court. IDScan's answer in the Bunch case was due September 29, according to the proof of service.

For you, that means there is nothing to file. No class has been certified, there is no settlement, no claim form and no deadline. Law firms advertising about IDScan are looking for clients; BleepingComputer counted several that “launched investigations into potential class-action litigation.” For what data breach settlements have paid in other cases, see our data breach settlement calculator; any dollar figure for IDScan today would be a guess.

• Enroll in IDScan's credit monitoring. The notice offers free credit monitoring and identity protection; call 1-833-516-2980 on weekdays between 8 a.m. and 8 p.m. Eastern, excluding holidays, to ask questions or enroll. The notice does not name the monitoring company or an enrollment deadline.
• Freeze your credit or place a fraud alert with all three bureaus. The notice lists TransUnion 1-800-680-7289, Experian 1-888-397-3742 and Equifax 1-888-298-0045. A name, a birth date and a license number are the kind of details used to open accounts in someone else's name; a freeze makes that much harder.
• Report misuse. If someone uses your identity, report it at IdentityTheft.gov or 1-877-438-4338, and to the police — the notice points out that you have the right to file a police report. If your license number itself is misused, ask your state's motor vehicle agency whether it will issue a new number — re-issuance is a state process with its own cost and delay.
• Watch your accounts. IDScan itself advises people to monitor their account statements for suspicious activity, and to be careful about sharing personal information with anyone who contacts them.

In Canada, the notice lists TransUnion and Equifax Canada and says a “Potential Fraud Warning” stays on a credit file for six years.

The notice is genuine and is posted at IDScan.net’s notice page, but it is hard to find: the page tells search engines not to list it (a “noindex” instruction, which BleepingComputer reported TechCrunch had spotted, and which was still in the page when we read it on September 30). The only IDScan contact details it gives are the call center at 1-833-516-2980 and a mailing address, 8814 Veterans Memorial Blvd, Suite 3-124, Metairie, LA 70003. Because there is no settlement, there is no settlement administrator and no payment. A text, email or call offering “IDScan settlement money,” asking for a fee, or asking you to type your license number into a site to “see if you were in the leak” is not from IDScan or from the court. If a business you dealt with — a rental company or a dispensary — writes to you about this incident, check the letter against that business's own website before calling any number in it. Our guides to IDX and Cyberscout breach letters show how to check a notice.

Hertz customers should not mix this up with the earlier Cleo file-transfer breach at Hertz, which has its own lawsuits — see our Hertz data breach page.

Most breaches expose what one company knew about its own customers. This one, if the sellers' claims hold, exposes what many businesses captured at the door — and, according to KrebsOnSecurity, some records hold six image files: front and back photos, a plain scan, and infrared and ultraviolet versions, the kinds of views ID checkers use to spot fakes. A card number can be cancelled; a license number and photo are much harder to replace. The court cases are at the very start, and the next date on the record is the October 13, 2026 submission date for the consolidation motion. This article reflects the record as of September 30, 2026.