IDScan.net Data Breach Exposes Government ID and Biometric Data

IDScan.net, a provider of identity verification and age validation technology, disclosed a data breach to the Oregon Attorney General on September 18, 2026. The incident, which IDScan.net indicated occurred on April 1, 2026, is currently under monitoring, according to public filings. The company specializes in processing and authenticating government-issued identification, meaning its systems contain significant volumes of sensitive personal information.

The reported exposure includes Full Name, Date of Birth, Mailing Address, Government ID Number, Driver's License Number, Scanned Identification Document Images, Biometric Metadata, Email Address, and Phone Number. This comprehensive set of identity credentials, originating from an identity verification service, is particularly sensitive as it includes foundational elements used for establishing and proving identity.

The exposure of such a wide range of identity data, particularly government identification numbers and scanned document images, carries elevated risks for affected individuals. Unlike typical compromises, these details are difficult to change and can be leveraged for sophisticated identity theft, creation of synthetic identities, or to bypass security protocols. Malicious actors could use this information to open fraudulent accounts or engage in impersonation.

Individuals who receive a breach notification from IDScan.net should consider immediately reviewing their financial statements and credit reports for any suspicious activity. Placing a fraud alert or instituting a credit freeze with the major credit bureaus can help prevent new accounts from being opened in their name. Additionally, remaining vigilant against unsolicited communications, particularly those asking for personal information, is a critical protective measure.

This incident highlights the challenges in securing extensive databases of identity credentials. Details surrounding the breach are based on information publicly filed by IDScan.net with regulatory authorities. Organizations that process and store government identification data are expected to maintain stringent security protocols to safeguard this high-value personal information.