Canada's Privacy Commissioner Investigates Massive IDScan.net Data Breach
The Office of the Privacy Commissioner has launched an investigation into a data breach at identity verification platform IDScan.net, which allegedly exposed millions of driver's license scans. While independent estimates suggest up to 153 million documents were stolen, official numbers remain unconfirmed.
The Office of the Privacy Commissioner (OPC) announced late Monday that it has opened an investigation into a significant data breach at IDScan.net, an online platform used by businesses to verify customers' government-issued identification.
Privacy Commissioner of Canada Philippe Dufresne initiated the inquiry following reports that an unauthorized third party accessed IDScan.net’s database and stole personal information, including digital scans of driver's licenses. The investigation will focus on examining the security safeguards implemented by IDScan.net and assessing whether the notifications provided to affected individuals were adequate under the Personal Information Protection and Electronic Documents Act (PIPEDA).
IDScan.net serves various sectors, including hospitality and nightlife establishments, allowing them to confirm the identities of their patrons. In a statement released on Sept. 4, the company confirmed that an unauthorized third party may have accessed or copied customer information stored in its cloud networks. This data reportedly includes full names and driver's license numbers.
The breach came to light after independent cybersecurity journalist Brian Krebs reported on Sept. 1 that he had discovered a dark web site selling digital scans of millions of driver's licenses belonging to people in the United States and Canada. Krebs estimated that approximately 153 million identity documents were stolen, with about 1.1 million results specifically linked to Canadian driver's licenses. However, neither IDScan.net nor any government agency in Canada or the U.S. has confirmed these specific figures.
In response to the incident, IDScan.net stated that potentially affected individuals would be contacted directly. The company also offered access to free credit monitoring and identity protection services to those impacted.
Law enforcement agencies are also engaged in the matter. The Royal Canadian Mounted Police (RCMP) stated last week that it was "monitoring" the situation and working with domestic and international law enforcement partners. Similarly, the U.S. Federal Bureau of Investigation (FBI) issued a brief statement on Sept. 2, noting that it was "looking into the incident" but declined to provide further comment due to the ongoing nature of the investigation.