Canadian privacy authorities have opened an investigation into IDScan.net following a major security breach involving digital copies of driver’s licenses and other government-issued identification.
The Office of the Privacy Commissioner of Canada is examining whether the identity verification company had adequate security safeguards before attackers gained access to information stored in its cloud environment. The investigation will also determine whether IDScan.net properly notified affected individuals as required under Canada’s federal private-sector privacy law.
IDScan.net provides technology that businesses use to verify government-issued identification. Its services are used in industries including hospitality and nightlife, meaning the company can handle particularly sensitive information collected when customers prove their identity.
The incident attracted attention after a dark-web marketplace called Nexus was reported to be offering access to a huge collection of identity documents from the United States and Canada. The marketplace claimed to possess approximately 153 million driver’s license records, alongside millions of other identification documents.
That figure has not been confirmed by IDScan.net or Canadian authorities as the number of people affected by the company’s breach. Reports about the marketplace also indicated that approximately 1.1 million searches corresponded to Canadian driver’s licenses, but the precise number of Canadian victims remains unknown.
IDScan.net publicly disclosed the security incident on September 4 after receiving information around September 1 indicating that data may have been accessed without authorization. The company later determined that an unauthorized third party may have accessed or copied customer information stored in accounts on the IDScan.net cloud.
Potentially compromised information includes full names and driver’s license numbers or other government-issued identification numbers. The wider collection advertised online reportedly contained digital images of identity documents, although authorities have not publicly established the complete scope of information taken from IDScan.net.
The company says it has been notifying potentially affected individuals and offering free credit monitoring and identity protection services. The FBI has also acknowledged looking into reports surrounding the stolen identity documents.
Canada’s investigation will now focus on IDScan.net’s security measures and its response to the incident under the Personal Information Protection and Electronic Documents Act. The privacy commissioner has not provided a timeline for completing the investigation, citing the active nature of the case.