Maybe IDScan wasn't permanently storing the records and deleted each one after analysis, but their platform was so thoroughly hacked that the instant a record was uploaded it was copied by the hackers. Not that that makes the situation any better.