Reassessing Your Identity Verification Vendor?

August 31, 2026 — Reporting indicates the “Nexus” marketplace listing was already active on a cybercrime forum. (zyphe.com)

September 1, 2026 — Public reporting linked the incident to IDScan, and IDScan later stated it received information on or around this date indicating certain data may have been accessed without authorization. (zyphe.com)

September 2, 2026 — The first class-action complaints related to the incident were filed in federal court in Louisiana. (zyphe.com)

September 3, 2026 — Additional litigation followed as more complaints were filed. (zyphe.com)

September 4, 2026 — Additional complaints were filed, bringing the reported total to nine within three days. (zyphe.com)

September 8, 2026 — Public reporting indicated IDScan had published a security-incident notice and was offering support services to potentially impacted individuals. (biometricupdate.com) 

1. What categories of personal data does the vendor collect?

2. What data is stored versus processed temporarily?

3. How long is data retained by default?

4. Can retention settings be customized by account, workflow, or document type?

5. Is sensitive data encrypted in transit and at rest?

6. Who can access stored customer data, and under what controls? 

7.  Are admin actions, exports, and policy changes logged and reviewable?
   
8. Does the vendor support role-based access controls and SSO
   
9. What subprocessors or third parties handle the data?
   
10. What is the vendor’s customer notification process after a confirmed incident?
    
11. What audit reports, certifications, or independent assessments are available?
    
12. Can customer data be deleted on demand or automatically after review?
     

1.  Were any of our records, users, images, or transactions affected?

2. What specific data elements do you store for our account?
3. What was our retention configuration at the time of the incident?
4. Can we shorten retention periods or reduce stored document data going forward?
5. What internal controls limit employee or contractor access to stored records?
6. What logs can you provide showing access, exports, policy changes, and submissions? 
7.  When did you first detect the issue, and when were customers notified?
8. What outside forensic, legal, or incident-response partners have been engaged?
9. What remediation steps have already been completed?
10. What additional remediation steps are still in progress?
11. Can you provide a written incident summary relevant to our account?

Choose from a variety of in-store scanners for the solution that best fits your needs

Create workflows easily to enable your clients to self-authenticate their identity when transacting remotely.

Don't have a fixed point-of-sale or checkout counter?  No problem, FraudFighter ID Mobile can give you the power to authenticate right from your mobile device.