Canada’s privacy commissioner has opened an investigation into the IDScan.net data breach, examining the company’s security safeguards and its notifications to people whose identification information was affected.
Commissioner Philippe Dufresne’s office said the inquiry follows reports that an unauthorized third party accessed the company’s database and stole personal information, including digital scans of driving licences and other identification documents. IDScan.net supplies technology used by businesses, including hospitality and nightlife establishments, to verify government-issued IDs.
The investigation will assess compliance with the Personal Information Protection and Electronic Documents Act, or PIPEDA, Canada’s federal private-sector privacy law. It covers both the safeguards in place when the breach occurred and the adequacy of the company’s notifications to affected individuals.
The Office of the Privacy Commissioner said it has been engaging with IDScan.net since the company issued a public advisory earlier this month. That contact is continuing as the regulator examines the incident and the steps being taken to mitigate risks to Canadians.
In its September 4 notice, IDScan.net said it received information around September 1 indicating that data might have been accessed without authorization. The company said it secured its systems and engaged outside specialists to investigate.
IDScan.net said an unauthorized party may have accessed or copied customer information stored in accounts on its cloud service. The affected information may include full names and driving licence or other government-issued identification numbers. It said it was notifying potentially affected people and offering free credit monitoring and identity protection services.
The incident had already prompted an FBI inquiry into an apparent breach involving IDScan.net. A dark-web service called Nexus advertised large collections of identification records, and security researcher Brian Krebs traced samples to identity checks performed at businesses using document-scanning technology.
Canada’s regulator separately issued guidance on handling biometric information under PIPEDA last year, addressing consent, data minimization, safeguards and retention. The current investigation specifically concerns the reported IDScan.net breach and the company’s handling of affected personal information.
IDScan.net says it is cooperating with federal law enforcement and reviewing its data-security policies and procedures. Its notice advises potentially affected individuals to review credit reports and account statements for suspicious activity and provides a dedicated contact channel for protection services.
Sources: Office of the Privacy Commissioner of Canada, IDScan.net, Krebs on Security
–
By the ID Tech Editorial Team
