IDScan.net Data Breach Notice (South Carolina Attorney General)

The filing from IDScan.net, submitted to the South Carolina Department of Consumer Affairs on September 18, 2026, states that personal information belonging to an unknown number of South Carolina residents was exposed. No passwords, no financial account numbers, and no permanent government identifiers such as Social Security numbers were listed in the notification.

No Passwords or Credentials Were Exposed

This is genuinely good news. Because the exposed data does not include any login credentials, your IDScan.net account itself is not at immediate risk of takeover. You do not need to change your password for this service. The breach concerns personal information only, which carries different risks and requires different responses.

What Personal Information Means in Practice

The notification lists personal information as the category exposed. In the context of IDScan.net’s service, this typically involves details provided during identity verification such as name, date of birth, address, or government-issued ID numbers other than those explicitly ruled out above. These pieces of information do not expire. Once they leave the company’s control they can be reused indefinitely by fraudsters to impersonate you when opening accounts, applying for services, or committing identity theft.

The record does not state how many people were affected. It also does not disclose when the incident occurred, only that the filing reached the state regulator on September 18, 2026. The letter is therefore the only reliable way to know whether your specific records were included.

How to Determine If You Are Affected

IDScan.net is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely your information was not part of this incident. However, if you have moved since the time the breach occurred, letters sent to your previous address may never have reached you. In that case, or if you are uncertain, contact IDScan.net directly to confirm whether your records were involved.

Why This Exposure Retains Long-Term Value

Unlike credit card numbers that can be replaced, the personal details listed in this filing cannot be reissued. A criminal who obtains your name combined with date of birth or driver’s license information gains a foundation for building a synthetic identity or for bypassing “know your customer” checks at other companies. Because IDScan.net specialises in scanning and verifying identity documents, the exposed records are especially useful to someone attempting to forge or misuse identity proofs elsewhere.

The absence of passwords and Social Security numbers in the filing limits the immediate danger but does not eliminate the need for vigilance. The information that was exposed remains valuable on the criminal market for years.

What You Can Still Control

You cannot make the exposed data disappear, but you can reduce what criminals can do with it. Monitoring for new account fraud and placing appropriate alerts gives you the best chance of catching misuse early. Because this breach involves identity-verification data rather than payment details, the focus shifts from card cancellation to broader identity monitoring.

Practical Steps Specific to This Incident

• Request your free credit reports from Equifax, Experian, and TransUnion and review them for accounts you do not recognise. New accounts opened in your name using stolen personal details are the most common consequence of this type of exposure.
• Place a fraud alert with the three major credit bureaus. A fraud alert requires lenders to take extra steps to verify your identity before opening new accounts, adding friction that deters opportunistic fraud.
• Monitor your mailbox and email for any communication from IDScan.net. If a notification arrives, read it carefully to see exactly which fields applied to you.
• Contact IDScan.net if you have changed addresses in the past year and have not received a letter. Ask them directly whether your verification records were part of the exposed set.
• Consider identity theft protection services that include dark-web monitoring for your name, date of birth, and driver’s license number. This breach makes those specific pieces of information more likely to appear for sale.

The filing contains only the facts required by South Carolina law. It does not describe how the exposure happened, how long any data may have been accessible, or what security measures were or were not in place. Those details remain unknown to the public. What matters most to you is that personal information left the company’s control and that you now have a practical way to watch for and limit the damage.