IDScan.net says cloud breach may have exposed VeriScan customer data

IDScan.net says an unauthorized third party accessed part of its cloud environment from April 4 to Sept. 2, 2026, in an incident limited to the VeriScan platform. The company is offering free credit monitoring and identity theft protection to potentially affected people as it continues its investigation and works with regulators.

Why it matters: - The incident may have exposed highly sensitive identity data, including driver’s license numbers, passport numbers and other government ID numbers. - Even without confirmed misuse, the type of data involved could raise fraud and identity theft risks for customers and end users. - The breach was limited to VeriScan, which narrows the scope but still leaves potentially affected people with practical steps to take.

What happened: - IDScan.net says it learned on or about Sept. 1, 2026, that some data may have been accessed without authorization. - The company says an unauthorized third party accessed part of its cloud environment from April 4, 2026, through Sept. 2, 2026. - The incident was limited to the VeriScan platform. - No other IDScan.net product or service was identified as affected. - IDScan.net says it secured its systems after discovering the issue, hired independent specialists and continues to investigate. - The company says it is also working with relevant regulatory authorities.

The details: - Potentially affected information could include a combination of full name, contact information, date of birth, driver’s license number, passport number and other government-issued ID numbers. - Not every person necessarily had all of those data elements involved. - The specific data at issue depends on how a customer used VeriScan and what information that customer chose to collect, process or retain. - IDScan.net says it is offering free credit monitoring and identity theft protection. - People with questions can call 1-833-516-2980, Monday through Friday from 8 a.m. to 8 p.m. Eastern, except holidays. - People can also write to 8814 Veterans Memorial Blvd, Suite 3-124, Metairie, LA 70003, United States. - IDScan.net says it is not aware of misuse of personal information tied to this event. - The company warns that some of the potentially affected information could still create a risk of fraud or identity theft. - IDScan.net urges potentially affected people to enroll in the free monitoring and protection services, review account statements for suspicious activity or errors, and be careful when sharing personal information online, by email or on social media. - The company says it continues to review and implement additional security measures to strengthen system protection.

Between the lines: - A cloud-based incident centered on a single product can still create a broad notification burden when that product handles identity verification data. - The absence of confirmed misuse lowers immediate alarm but does not eliminate the need for caution because the exposed data type is valuable to fraud actors. - The company’s outreach includes consumer-protection guidance that suggests it expects some level of downstream concern even without evidence of active abuse.

What's next: - IDScan.net says the investigation is ongoing. - The company will likely continue notifying impacted customers and coordinating with regulators as findings develop. - Potentially affected people in Canada can seek additional credit and identity-theft guidance from TransUnion, Equifax, Quebec’s access-to-information commission, the Office of the Privacy Commissioner of Canada and the Canadian Anti-Fraud Centre. - Canadian residents can request a fraud alert with the major credit bureaus, and that alert can remain on a credit file for six years unless changed or removed in writing.

The bottom line: - IDScan.net is treating the incident as a limited VeriScan cloud breach, but the data involved is serious enough to justify credit monitoring, identity protection and close account review.