Within a month, class-action lawsuits filed against a New Orleans software company have doubled following a data breach that potentially leaked as many as 150 million U.S. and Canadian driver's licenses to the dark web.
IDScan.net, the company believed to be at the center of the leak, is accused in 19 separate lawsuits of failing to safeguard personal identifiable information, allowing cybercriminals to infiltrate its servers and steal sensitive information.
Industries spanning from travel to retail and nightlife use IDScan's technology to verify the identities and ages of prospective clients. Defendants cite Hertz, Target, and Caesars Entertainment as some of their high-profile clients.
In early September, investigative cybersecurity news blog KrebsOnSecurity first reported that dark-web service Nexus listed millions of scans of U.S. and Canadian driver's licenses, travel documents, and medical cards for sale.
Following the FBI's announcement of an investigation into the matter, IDScan revealed that "an unauthorized third party" hacked into its servers between April and September. The company added that the leaked information possibly involved names, birth dates, information, and government-issued identification numbers.
IDScan offered free credit monitoring and identity protection services to people potentially impacted by the leak and said it is making security adjustments.
"IDScan.net takes protecting the privacy and security of personal information seriously. We are reviewing and implementing further security enhancements designed to strengthen the protection of our systems," the company wrote on its website.
Class-action defendants believe the leak could've been avoided with one Nevada-based lawsuit accusing IDScan of failing to take reasonable "security procedures and practices" such as encryption or deleting sensitive data when it's no longer needed.
"Due to Defendants' negligent failure to secure and protect Plaintiff's and Class Members' Private Information, cybercriminals have stolen and obtained everything they need to commit identity theft and wreak havoc on the financial and personal lives of thousands of individuals," the lawsuit read.
The cases allege negligence, violation of Federal Trade Commission policies, and failure to comply with industry standards, among other claims.
The defendants are seeking a jury trial and financial relief.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
