IDScan.net data breach: ID scans from the VeriScan platform, and why your bank wrote to you

Why did my bank send me an IDScan.net letter?

Your ID was scanned with VeriScan by a business that uses IDScan.net. PeoplesBank's letter says the bank uses IDScan.net to verify customers' identity, and that the reader's ID was scanned at a PeoplesBank banking center before September 2026. IDScan.net says what was involved depends on how each customer organization used VeriScan and what it chose to store. Its notice refers to customer organizations in general, so customers of other businesses that use VeriScan may be involved too. The guide to letters from companies you never dealt with explains how a vendor's breach reaches you.

What happened at IDScan.net?

IDScan.net says it received information on or around September 1, 2026 suggesting some data may have been accessed without authorization. It secured its systems and brought in outside specialists. Its investigation found no other IDScan.net products or services involved. It posted its notice on September 4 and updated it on September 29, 2026.

Date	What the notices and the regulators' records say
April 4, 2026	Unauthorized access to part of IDScan.net's cloud environment begins
September 1, 2026	IDScan.net receives information about possible unauthorized access
September 2, 2026	Access ends
September 4, 2026	IDScan.net posts its notice
September 8, 2026	IDScan.net tells PeoplesBank, per the bank's letter
September 18, 2026	IDScan.net's own report logged in Massachusetts (1 resident)
September 21, 2026	IDScan.net's report posted by Texas (1 Texan)
September 30, 2026	PeoplesBank's report logged in Massachusetts (23,731)
October 8, 2026	PeoplesBank's notice to Indiana (27,624 total)

The access had gone on for almost five months when IDScan.net received that information.

What information was involved?

IDScan.net says the information could include a combination of full name, contact information, date of birth, driver's license, passport and other government ID numbers, varying by customer organization. PeoplesBank's letter lists full name, address, driver's license or state ID number and date of birth. Massachusetts records only driver's licenses as breached for PeoplesBank's report: no Social Security numbers, financial accounts or card numbers.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	PeoplesBank notice, total affected	27,624
Massachusetts consumer affairs office	PeoplesBank notice, Massachusetts residents	23,731
Massachusetts consumer affairs office	IDScan.net's own report	1
Texas attorney general	IDScan.net's own report	1

These counts cover PeoplesBank's customers and IDScan.net's direct reports only. No record gives a total across all businesses that used VeriScan.

What is IDScan.net offering?

Free credit monitoring and identity protection, enrolled through IDScan.net's line.

Item	Detail
Enrollment and questions	1-833-516-2980, Monday to Friday, 8 a.m. to 8 p.m. ET, excluding holidays
Notice page	idscan.net/notification-data-security-incident
Postal address	8814 Veterans Memorial Blvd, Suite 3-124, Metairie, LA 70003

What the documents leave open

• Which other businesses used VeriScan and are writing to their customers.
• How the third party got into IDScan.net's cloud environment.
• The total number of people across all VeriScan customers.