IDScan.net was the subject of a data breach notification filed with the OR Attorney General. The AG filing was recorded on September 18, 2026. The breach or discovery date reported in the filing is April 1, 2026.
Data Exposed
IDScan.net was the subject of a data breach notification filed with the OR Attorney General. The AG filing was recorded on September 18, 2026. The breach or discovery date reported in the filing is April 1, 2026.
IDScan.net operates at the critical intersection of identity verification, age validation, and data parsing technology, providing advanced software and hardware solutions used to capture, parse, and authenticate government-issued identification cards, driver's licenses, and passports. Because their clients span high-security sectors including hospitality, gaming, law enforcement, banking, and age-restricted retail, IDScan.net processes and archives massive volumes of highly sensitive Personally Identifiable Information (PII). The company's infrastructure is designed to ingest and store intricate identity credentials, making its databases a high-value repository for cybercriminals seeking raw data capable of facilitating comprehensive digital impersonation. The security incident reported to the Oregon Attorney General in 2026 highlights the pervasive vulnerabilities inherent in managing centralized identity verification databases and third-party software integrations. While the exact vector remains under active investigation, breaches of identity technology firms typically involve unauthorized external access, credential stuffing, or the compromise of cloud storage environments where parsed document data and scanning logs are maintained. Because IDScan.net handles raw image files of identification documents alongside structured demographic and biometric records, a successful penetration of their systems implies that attackers may have bypassed perimeter defenses to access deep storage archives containing historical scan logs. The exposure of data originating from an identity verification platform creates severe, multi-faceted risks for affected consumers. Unlike a standard retail breach where only a credit card or email address might be compromised, an IDScan.net breach potentially exposes full legal names, dates of birth, physical addresses, government identification numbers, and biometric metadata extracted directly from scanned driver's licenses or passports. This constellation of data is exceptionally dangerous because government ID numbers and document images cannot be easily changed or reset like a password. Malicious actors can leverage these details to construct sophisticated synthetic identities, open fraudulent financial accounts, execute targeted phishing campaigns, bypass know-your-customer (KYC) security protocols on financial platforms, and commit wide-scale identity theft that can plague victims for years. As an entity collecting and processing sensitive consumer credentials, IDScan.net operated under strict legal obligations to implement robust, industry-standard cybersecurity measures to protect stored PII. Under Oregon state data protection laws, as well as overarching federal standards enforced by the Federal Trade Commission Act, companies holding high-risk personal data are legally required to maintain reasonable security safeguards, including encryption at rest and in transit, multi-factor authentication, rigorous access controls, and regular vulnerability assessments. The occurrence of a data breach compromising sensitive identity records strongly suggests potential failures in these foundational security duties, raising serious questions about whether adequate encryption and monitoring protocols were actively enforced across all storage environments. Receiving a data breach notification letter from IDScan.net is a formal acknowledgment that your private identity information was compromised due to inadequate corporate security practices, and it provides you with the legal standing necessary to participate in a class action lawsuit. In data privacy litigation, affected individuals do not need to prove that they have already suffered direct financial loss to seek legal recourse; the mere exposure and misappropriation of your sensitive data constitutes a compensable injury under modern consumer protection jurisprudence. Our law firm is investigating this breach on a contingency fee basis, meaning there is never any out-of-pocket cost or financial risk to you, and we only collect a fee if we successfully recover compensation on your behalf.
Based on the data types reported, affected individuals face:
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
Phone numbers exposed in breaches are used for SIM swapping attacks — hijacking your number to bypass two-factor authentication on financial accounts.
What the Oregon Consumer Information Protection Act and federal statutes entitle you to recover:
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
Data breach victims regularly report anxiety, loss of sleep, and ongoing fear of identity theft. These non-economic harms are cognizable injuries in data breach litigation, particularly in cases involving SSN or medical record exposure.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under Oregon Consumer Information Protection Act and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
State statutes of limitations for data breach claims typically run 2–4 years from the date of the breach or its discovery. Because this breach was recently disclosed, the window is open — but acting early preserves your options and strengthens the case.
Accepting free credit monitoring from IDScan.net does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by IDScan.net during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Most data breach class actions resolve within 18 to 36 months, though timelines vary by court and complexity. Your participation requires minimal effort — typically completing a claim form. Our office handles all litigation; you are notified when a settlement is reached.
Received a notification letter from IDScan.net?
What it means and what to do next.
Case review window ends November 13, 2026 — review your letter.
Review Your Letter →IDScan.net breach?
Free case review · No fee unless you win