Harborside has notified customers that identification information collected at its stores may have been exposed in the IDScan.net VeriScan breach. The retailer’s notice details the identity fields, document images and scan records potentially involved, and says it is reviewing retention policies and vendor oversight.
VeriScan is the platform Harborside uses to scan and verify customer identification. According to the notice, an unauthorized person accessed part of IDScan.net’s cloud system between April 4 and September 2. The provider learned of possible unauthorized access around September 1 and notified Harborside on September 4.
Potentially affected information includes names, home addresses, dates of birth, sex, driver’s license or state ID numbers, issuing states, issue and expiration dates, and document control numbers. Images of the front of scanned IDs may expose photographs, signatures and printed physical descriptors, including height, weight, and hair and eye color.
Scan records may also include the date and time, store, approximate GPS location of the scanning device, and VeriScan’s document-authenticity result. Harborside said not every information type was necessarily involved for every customer. Its own systems were not involved, and the notice reports no indication that payment information or purchase history was affected.
The retailer said IDScan.net secured its systems, brought in outside specialists and is adding security improvements. Harborside is reviewing its data-retention and privacy policies, together with oversight of vendors handling customer information, with the aim of reducing information collected and shared between systems.
The incident has already prompted a Canadian privacy investigation into IDScan.net’s safeguards and breach notifications. That inquiry examines compliance with the Personal Information Protection and Electronic Documents Act, Canada’s federal private-sector privacy law.
An FBI inquiry also followed reports of identification scans offered through a dark-web service. Harborside’s notice describes the retailer-specific exposure within the previously disclosed VeriScan incident.
IDScan.net is offering affected customers 12 months of free credit monitoring and identity protection. Customers can enroll through IDScan.net’s dedicated incident phone line. Harborside’s notice advises customers to review account statements and credit reports, consider a fraud alert or credit freeze, and contact the issuing agency if their license or ID number is being misused.
Sources: Harborside
–
By the ID Tech Editorial Team
