Canadian investigation launched into data breach that exposed millions of IDs

Privacy commissioner will look into IDScan.net breach involving Canada-issued driver's licences

Canada's privacy commissioner has launched an investigation into a data breach at IDScan.net that potentially exposed details from millions of driver's licences and other kinds of government-issued identification from Canada and the U.S.

IDScan.net provides identification verification software to several categories of businesses, from bars and casinos to car rental companies.

Earlier this month, the company published a public notice about a data security incident, stating that "an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud."

Woman flagged by ID scanner as nationwide 'public safety concern' after incident in Winnipeg bar

ID scan technology at Alcanna liquor stores collected too much data, says investigation

The company said it was notifying individuals who had potentially been affected and offered free credit monitoring services.

Two days before IDScan.net published its alert, the FBI confirmed it was looking into the reported theft of tens of millions of driver's licences belonging to people in the U.S. and Canada that were being sold on the dark net.

The bureau said it was "looking into the incident" but could not comment "due to the ongoing nature of the investigation."

Unprecedented in size and scope

The breach could be one of the largest-ever exposures of government-issued identity documents in North America.

Zach Edwards, a threat researcher at the cybersecurity company Infoblox, told Reuters the incident was unprecedented in terms of its sweep.

"There's never been a breach of driver's licences at this scale," said Edwards, who added that he discovered his own license was part of it. Edwards said that the ongoing nature of the breach "means that this attack created legitimate national security risks for high-profile individuals."

Canada's Office of the Privacy Commissioner says it's examining the security safeguards IDScan.net had in place at the time of the breach and whether its actions to notify potentially affected Canadians were adequate.

The probe will also look at whether IDScan.net breached Canada’s federal private-sector privacy laws.