A company in the business of identity verification has now found itself at the source of a leak—that's the backdrop to IDScan.net's announcement this week. The platform, which specializes in ID fraud prevention services, says it will offer free credit monitoring and identity protection services to customers affected by the data security incident as a form of compensation.
IDScan.net has not publicly linked this incident to last week's reports, though the timing is close. According to the company's statement, the investigation is still ongoing, but it has confirmed that "an unauthorized third party may have accessed and copied certain customer information stored in an IDScan.net cloud account." The types of data potentially affected include customers' full names and driver's license or other government-issued ID numbers.
The company states that obtaining this information in full "would require payment," and it is currently reaching out to potentially affected customers while offering free credit monitoring and identity protection services. IDScan.net also says it is cooperating with federal law enforcement in the investigation.
Journalist Brian Krebs reported on his blog KrebsOnSecurity on September 1 that a dark web marketplace called Nexus was selling over 153 million scanned US and Canadian driver's licenses, along with millions of copies of other identity documents. According to the report, Nexus shut down before the FBI's investigation got underway, and Krebs' reporting suggested IDScan.net may have been one of the sources of this identity document data.
Engadget has reached out to IDScan.net to ask whether there is any connection between this incident and the Nexus marketplace, but has not received a response as of publication.
