NEW ORLEANS – More proposed class action lawsuits have been filed against an identity verification and ID scanning technology company based in New Orleans, according to a recent search of federal court filings.
Three separate, but related, class action complaints were filed against defendant IDScan.net Inc. in U.S. District Court for the Eastern District of Louisiana last month.
Plaintiffs Diamond Pugh of North Carolina and Stacey Torres of Nevada filed a 65-page complaint in the Eastern District of Louisiana. And two nearly identical 38-page complaints were filed by plaintiffs Marius Sakalinskas of Massachusetts and Billy Robert Chambers of Alabama.
“Due to Defendants’ negligent failure to secure and protect Plaintiffs’ and Class Members’ Private Information, cybercriminals have stolen and obtained everything they need to commit identity theft and wreak havoc on the financial and personal lives of thousands of individuals,” the 65-page complaint states.
IDScan.net helps businesses authenticate documents, verify age, and prevent fraud.
As part of its business practices and to provide services or products, the company collects, stores, and maintains customers’ Personally Identifiable Information, or PII.
In a Sept. 4 news release, IDScan.net claims it received information Sept. 1 indicating that certain data may have been accessed without authorization.
According to the filings, the unauthorized access resulted in more than 153 million driver’s license scans, more than 10 million scans of other government-issued identification and travel documents – including state identification cards, international travel cards, and medical and marijuana-dispensary cards – as well as front- and back-side images and infrared and ultraviolet scans of such documents, that are now for sale on the Dark Web on a new service called Nexus.
Nexus claims it has been collecting these driver’s license and other ID scans for more than a year.
“Now, and for the rest of their lives, Plaintiffs and Class Members will have to deal with the danger of identity thieves possessing and misusing their Private Information,” the 65-page complaint states. “Even those Class Members who have yet to experience identity theft will have to spend time responding to the Data Breach and are at an immediate and heightened risk of all manners of identity theft as a direct and proximate result of the Data Breach.”
The plaintiffs in the three class actions argue IDScan.net has failed to notify the victims of the data breach that their private information was compromised.
“Thus, most, if not all Class Members are unaware that their Private Information has been compromised, are unaware of the need to remain vigilant against further misuse of their Private Information, and that they are, and continue to be, at a significant risk of identity theft, fraud, and other forms of harm,” the 65-page complaint states.
The plaintiffs contend they provided their private information to the company with the “mutual understanding” that it would safeguard their information and would implement “sufficient cybersecurity safeguards” to protect their information.
“Businesses that store and maintain customers’ Private Information, like Defendants, owe the individuals to whom the information relates a duty to adopt reasonable measures to protect it from unauthorized disclosures and unauthorized third parties,” the 65-page complaint states.
“In providing their Private Information to Defendants, Plaintiffs and the Class Members reasonably expected these sophisticated business entities to keep their Private Information confidential and secured from unauthorized disclosures, to use this Private Information for business purposes only, and to disclose it only as authorized.
“Defendants failed to do so, resulting in the unauthorized disclosure of Plaintiffs’ and Class Members’ Private Information in the Breach.”
IDScan.net, in its news release, argues it took “immediate steps” to secure its systems and engaged a team of third-party specialists to help determine the “full nature and scope” of the incident.
“This investigation is currently ongoing,” the company stated. “We continue to cooperate with applicable regulatory and law enforcement authorities.”
Its investigation thus far has determined that a portion of its cloud environment was accessed between April 4 and Sept. 2, and the event was limited to the VeriScan platform.
“IDScan.net takes protecting the privacy and security of personal information seriously,” it said in the statement. “We are reviewing and implementing further security enhancements designed to strengthen the protection of our systems.”
IDScan.net is facing more than a dozen similar class actions in the Eastern District of New Orleans and other jurisdictions as a result of last month’s data breach.
Murray Law Firm in New Orleans is representing Pugh and Torres in their class action; Bryson Harris Suciu & DeMay PLLC in New Orleans is representing both Sakalinskas and Chambers.
