Free consultation · No obligation786-306-7278
DataBreachClassActions.com
MonitoringOregon AG filing · September 18, 2026

IDScan.net Data Breach Exposes Sensitive Identity Data in Oregon

IDScan.net, a company specializing in identity verification, reported a data breach to the Oregon Attorney General on September 18, 2026. This incident may have exposed highly sensitive personal information, including government ID details and biometric data, for individuals who had their identification documents scanned through their systems.

This breach is real, not a scam. IDScan.net officially reported it to the Oregon Attorney General on September 18, 2026.

Reviewed by David S. Harris, Esq., data breach and class action attorney (Florida Bar No. 0112739). Free consultation: 786-306-7278

Received a IDScan.net notification letter? Find out in minutes if you qualify for compensation.

Free case review
State
Oregon
Breach date
April 1, 2026
Reported
September 18, 2026

What may have been exposed

  • Full Name
  • Date of Birth
  • Mailing Address
  • Government ID Number
  • Driver's License Number
  • Scanned Identification Document Images
  • Biometric Metadata
  • Email Address
  • Phone Number

IDScan.net, a provider of identity verification and age validation technology, disclosed a security incident to the Oregon Attorney General on September 18, 2026. This breach involved systems that process and store data from scanned government identification. The company's platforms are used across various high-security sectors, making the stored information particularly valuable to malicious actors.

The compromised data types are extensive and include Full Name, Date of Birth, Mailing Address, Government ID Number, Driver's License Number, Scanned Identification Document Images, Biometric Metadata, Email Address, and Phone Number. This combination of highly personal and difficult-to-change information puts affected individuals at significant risk.

Such a broad exposure of identity credentials creates severe risks for affected consumers. Unlike typical data breaches, the compromise of government ID numbers and document images means that individuals cannot simply change a password to protect themselves. This data can be exploited for advanced identity theft, creation of synthetic identities, and bypassing security protocols on various online platforms, potentially leading to long-term financial and personal distress.

Companies like IDScan.net, which handle vast amounts of sensitive personal data, have a legal obligation to implement robust cybersecurity measures. The occurrence of this breach raises questions about the adequacy of their security safeguards, including proper encryption, access controls, and vulnerability management, which are critical for protecting such high-value information.

If you received a data breach notification letter from IDScan.net, your sensitive personal information was likely exposed. You may have legal rights and options available, including participating in a class action lawsuit to seek compensation. Our firm is currently investigating this incident and offers a free, no-obligation case review to help you understand your potential claims.

What to do if you were affected

Based on the categories of information reported in this filing, these steps can help limit the risk of identity theft and fraud.

  • Replace exposed ID documents

    Contact your state DMV or the issuing agency about replacing an exposed driver's license, passport, or government ID number.

  • Secure your online accounts

    Change the password on any account that reused an exposed password and turn on two-factor authentication wherever it's offered.

  • Stay alert to targeted scams

    Be cautious of calls, texts, or emails that reference this breach. Legitimate organizations won't ask you to confirm sensitive details through an unsolicited message.

  • Keep your notification letter

    Save the notice you received. It documents that your information was involved and is often needed to enroll in any credit monitoring offered or to join a related legal claim.

Source: Oregon Attorney General filing

Related data breach cases