Canada’s privacy commissioner has launched an investigation into a data breach at an identity-verification company involving stolen identification details, including digital scans of driver’s licences.
Privacy Commissioner Philippe Dufresne is looking into the breach at IDScan.net after his office received reports that an unauthorized third party accessed the company’s database and stole personal information, including digital scans of driver’s licences and other identification, the agency said in a Sept. 21 release.
Businesses such as hospitality and nightlife establishments in Canada and the United States use IDScan.net’s technology to verify customers’ government-issued identification.
The Office of the Privacy Commissioner (OPC) said Dufresne’s investigation will examine the security safeguards IDScan.net had in place, along with the “adequacy of its notifications to affected individuals.”
The investigation will determine whether the company complied with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law.
IDScan.net issued a public advisory about the incident on Sept. 4. Since then, the OPC said it has been engaging with the company to ensure it is taking necessary steps to address the incident and mitigate risks to Canadians.
In its public advisory, IDScan.net said it received information around Sept. 1 that “certain data may have been accessed without authorization.” The company said it then secured its systems and engaged a team of third-party specialists to “help determine the full nature and scope of the incident.”
“This investigation is currently ongoing,” the company said.
IDScan.net said it determined that an unauthorized third party may have accessed and/or copied customer information stored on the cloud. The information included full names and driver’s licences or other government-issued identification numbers.
“Though full access to the information required payment, in an abundance of caution, we are notifying potentially impacted individuals of this incident and providing access to free credit monitoring and identity protection services,” the tech company said.
IDScan.net encouraged people who may have been affected to remain vigilant against possible identity theft and fraud by reviewing their credit reports and account statements for suspicious activity and errors. The company also said individuals can place a fraud alert or credit freeze on their accounts by contacting credit-reporting agencies.
“In response to this incident, we immediately began an investigation and reviewed our policies and procedures related to data security,” IDScan.net added. “We are also co-operating with federal law enforcement on their investigation.”
FBI Investigation
Around the time of the breach, the FBI said on Sept. 2 that it was investigating a site on the dark web after reports that it was offering more than 150 million U.S. and Canadian driver’s-licence scans.
The dark web is a hidden part of the internet accessible through specialized software that can provide users with greater anonymity and is often used for illegal activity.
Independent journalist Brian Krebs was the first to report on the criminal site, called Nexus, which was advertised on a Russian cybercrime forum with his Virginia driver’s licence appearing as a free sample.
That caught his attention and led him to examine the rest of the site.
Krebs published a report on Sept. 1 detailing that the site claimed to be offering digital scans of more than 150 million U.S. and Canadian driver’s licences. He said nine people whose licences appeared on the site confirmed to him that the scans were genuine.
The site went offline after Krebs’s report. While it was active, Nexus claimed to have driver’s-licence scans belonging to people in the United States and Canada. Canadian records represented some of the total, while most of the records involved American licences.
The number of records advertised by Nexus has not been independently verified as the number of people affected by the IDScan.net breach, and the Privacy Commissioner’s investigation into the incident remains ongoing.
English (US) · 
Turkish (TR) · 