Privacy Commissioner Probes Massive IDScan.net Data Breach
AI-generated image · Bay Street Wire
Investigation launched after millions of North American government IDs were potentially exposed via identification verification software.
Canada's privacy commissioner has opened an investigation into a data breach at IDScan.net, a provider of identification verification software used by businesses such as casinos, bars, and car rental companies. According to CBC Toronto, the breach potentially exposed details from millions of government-issued IDs, including driver's licences, from both Canada and the United States.
In a public notice issued earlier this month, IDScan.net stated that an unauthorized third party may have accessed or copied customer information stored in cloud accounts. The company is offering free credit monitoring and notifying affected individuals.
Two days prior to the company's alert, the FBI confirmed it was investigating the theft of tens of millions of driver's licences from Canada and the U.S. that were appearing for sale on the dark net. While the FBI declined to comment further due to the ongoing investigation, Zach Edwards, a threat researcher at Infoblox, told Reuters the scale of the breach is unprecedented. Edwards noted that the incident creates national security risks for high-profile individuals.
Canada's Office of the Privacy Commissioner is currently evaluating whether IDScan.net violated federal private-sector privacy laws, the adequacy of its notification process, and the security safeguards in place during the breach.