DataBreachCaseFile.com

Case file

Case File: IDScan.net Data Breach

This file collects the dated facts on record for the IDScan.net incident. The state report is dated September 18, 2026. The incident itself is dated April 1, 2026.

Timeline

170 days separate the incident date from the date it was reported.

  1. April 1, 2026Incident dateWhen the filing says the breach took place.
  2. September 18, 2026Report filed in OregonDate the notice was lodged with the Oregon Attorney General.

Case facts

Filing state
Oregon
Date reported
September 18, 2026
Incident date
April 1, 2026
Receiving office
Oregon Attorney General

Data categories in the file

  • Full Name
  • Date of Birth
  • Mailing Address
  • Government ID Number
  • Driver's License Number
  • Scanned Identification Document Images
  • Biometric Metadata
  • Email Address
  • Phone Number

Case notes

IDScan.net, a provider of identity verification and age validation technology, disclosed a data breach to the Oregon Attorney General on September 18, 2026. The incident, which IDScan.net indicated occurred on April 1, 2026, is currently under monitoring, according to public filings. The company specializes in processing and authenticating government-issued identification, meaning its systems contain significant volumes of sensitive personal information.

The reported exposure includes Full Name, Date of Birth, Mailing Address, Government ID Number, Driver's License Number, Scanned Identification Document Images, Biometric Metadata, Email Address, and Phone Number. This comprehensive set of identity credentials, originating from an identity verification service, is particularly sensitive as it includes foundational elements used for establishing and proving identity.

The exposure of such a wide range of identity data, particularly government identification numbers and scanned document images, carries elevated risks for affected individuals. Unlike typical compromises, these details are difficult to change and can be leveraged for sophisticated identity theft, creation of synthetic identities, or to bypass security protocols. Malicious actors could use this information to open fraudulent accounts or engage in impersonation.

Individuals who receive a breach notification from IDScan.net should consider immediately reviewing their financial statements and credit reports for any suspicious activity. Placing a fraud alert or instituting a credit freeze with the major credit bureaus can help prevent new accounts from being opened in their name. Additionally, remaining vigilant against unsolicited communications, particularly those asking for personal information, is a critical protective measure.

This incident highlights the challenges in securing extensive databases of identity credentials. Details surrounding the breach are based on information publicly filed by IDScan.net with regulatory authorities. Organizations that process and store government identification data are expected to maintain stringent security protocols to safeguard this high-value personal information.

Questions about this case file

Where does the IDScan.net case file come from?
Every entry is taken from the breach report IDScan.net lodged with the Oregon Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?
Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?
It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?
Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

More Oregon case files

Oregon data breaches

Filing source: Oregon Attorney General