Breach at U.S. ID-scanning firm IDScan.net exposes Canadian driver's licences
An identity theft service advertised on a Russian-language cybercrime forum offered scans of more than 153 million driver's licences from the United States and Canada, including roughly 1.1 million Canadian licences, in what investigators linked to a breach at New Orleans-based identity verification company IDScan.net. The FBI's New Orleans field office opened an investigation on Sept. 1, according to KrebsOnSecurity, which first reported the service.
The case matters for Canadians because the scans were not collected by governments. They were taken at retail counters, car rental desks and cannabis dispensaries that use ID-scanning technology to check age and identity. Searches limited to Canadian licences returned about 1.1 million results, with Ontario accounting for the largest share at more than 470,000 records, Krebs reported.
What happened
The service, called Nexus, claimed to hold more than 153 million driver's licences, over 10 million ID cards, more than three million travel or international IDs and at least 579,000 medical cards. Its operators said the images came from an active breach at a major identity verification company. Each record could include several image files, including front and back scans and infrared and ultraviolet images, stamped with dates and times.
Krebs matched timestamps on several licences, including his own, to car rentals and dispensary visits, and found links to IDScan.net, which lists Hertz, Target and FedEx among its clients. The Nexus site disappeared from the dark web the evening the story was published.
IDScan.net said it learned of the breach on or around Sept. 1. In a Sept. 4 announcement it said hackers obtained user data held in its cloud platform, and it later said an unauthorized third party may have accessed or copied full names and driver's licence or other government ID numbers. It said it is notifying affected people and offering credit and identity protection. The company has not said how many people were affected or confirmed that every Nexus record came from its systems.
Canadian investigation
On Sept. 21, Privacy Commissioner of Canada Philippe Dufresne opened an investigation into IDScan.net under Canada's federal private-sector privacy law, The Record reported. The probe will examine the company's security safeguards at the time of the breach and whether its notices to affected people were adequate.
What to do
Anyone who has had a licence scanned at a car rental counter, store or dispensary should watch for a notice from IDScan.net and enrol in any monitoring offered. Treat unsolicited calls, texts or emails about the breach with suspicion, and consider asking your provincial licensing office whether a replacement licence number is available if you see signs of identity fraud. A stolen licence image can be used to open accounts, so check your credit report with Equifax Canada and TransUnion Canada.
