A notice dated September 4 but not widely shared shows that IDScan acknowledged a data breach but did not specify how many people were affected.