What allegedly happened

Over the past week, a dark‑web service advertised access to more than 153 million scanned identity documents, and reporting traced the samples back to an identity verification vendor called IDScan. The marketplace — which has since gone offline — claimed to be selling driver’s licenses, ID cards, travel documents, and other sensitive records.

Security researchers checked samples against known records and found matches that pointed toward the vendor’s systems. Law enforcement, including the FBI, has confirmed it is looking into the matter. The company at the center of the story has not released a public statement explaining what happened or how many people might be affected.

Although the public-facing illicit service is no longer online, copies of the stolen data are reported to still exist among criminals. Some of the leaked items were described as especially sensitive, but those specific claims have not been independently verified.

Who’s affected and what comes next

Multiple lawsuits were filed in Louisiana — where the company is headquartered — accusing the vendor of failing to protect customer data. The complaints say businesses that use the company’s ID‑scanning tools (car rental companies, retailers, gun shops, banks, cannabis dispensaries, and hospitality outfits, among others) may have had customers’ documents captured and exposed without adequate safeguards.

Some law firms are already investigating potential class actions and are looking for people whose IDs were scanned at businesses using the service. The vendor reportedly began notifying certain business customers in early September, but individual notifications and the full scope of exposure are still unclear.

Given the scale of the allegations, expect more lawsuits to appear, possible consolidation into multidistrict litigation, and separate probes by state attorneys general or federal regulators. Those follow-ups are fairly common after large data incidents.

Quick safety checklist (do the boring but useful stuff):

  • Keep an eye out for phishing and impersonation attempts — attackers love fake calls and texts that reference your ID.
  • Consider freezing your credit if you suspect your ID was involved — it’s the easiest way to block new accounts.
  • Monitor bank and credit card statements for unfamiliar charges, and enable multi‑factor authentication where possible.
  • If you get an official notice, follow the guidance but be wary of contact that arrives by unexpected phone or text asking for more personal info.

Update [September 4]: The FBI has confirmed an investigation into the incident.