Canada’s federal privacy regulator has opened an investigation into the recent IDScan.net data breach, following reports that an unauthorized party accessed and stole sensitive identification information from the company’s database.
The Office of the Privacy Commissioner of Canada said on September 21 that Privacy Commissioner Philippe Dufresne had launched the investigation after reports that digital scans of driver’s licences and other identification documents were taken from IDScan.net. The company provides identity verification technology used by businesses, including hospitality and nightlife establishments.
The breach came to light after reports that a dark web marketplace was offering millions of identification documents belonging to people in the United States and Canada. KrebsOnSecurity previously reported that more than 153 million digital scans of US and Canadian driver’s licences were being offered through the service, prompting an FBI inquiry into the source of the images.
The exposed material reportedly included detailed scans of identification documents. In some cases, licence records contained multiple images of the same document, including versions captured using different imaging methods. The incident has raised concerns because stolen identity documents can potentially be used for identity theft, impersonation and other forms of fraud.
The Canadian investigation will examine the security safeguards IDScan.net had in place when the breach occurred. The Office of the Privacy Commissioner will also assess whether the company provided adequate notifications to affected individuals under Canada’s Personal Information Protection and Electronic Documents Act, or PIPEDA.
The privacy regulator said it has been communicating with IDScan.net since the company issued a public advisory about the incident earlier this month. It will continue working with the company to ensure appropriate steps are taken to address the breach and reduce risks to Canadians.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Because the investigation is still active, the Office of the Privacy Commissioner said it cannot provide additional details at this stage. It has also not announced when the investigation is expected to be completed.
