Canadians' ID scans swept up in IDScan.net breach, privacy watchdog investigates

Canadians who had their driver's licence scanned at a bar, nightclub, hotel or other business may be caught up in a breach at identity-verification company IDScan.net, and the Office of the Privacy Commissioner of Canada said on Sept. 21 it has opened an investigation into the incident.

Unlike a leaked email address, a stolen image of a government ID cannot be changed. Scans of licences and other identity documents are prized by fraudsters because they can be used to open accounts, pass verification checks and impersonate the holder.

What happened

The breach came to light in early September when security journalist Brian Krebs reported that a dark-web identity-theft service called Nexus was advertising access to more than 153 million U.S. and Canadian driver's licence scans, along with millions of other ID cards and travel documents. Krebs traced the data to IDScan.net, a Louisiana-based company whose hardware and software are used by car rental firms, retailers, cannabis dispensaries and hospitality businesses to check customers' identification, BleepingComputer reported. The 153 million figure comes from the seller's advertisement and has not been independently confirmed.

According to the privacy commissioner's announcement, an unauthorized party reportedly accessed IDScan.net's database and stole personal information, including digital scans of driver's licences and other types of identification. The commissioner's office said it has been engaging with the company since IDScan.net issued a public advisory earlier in September.

Commissioner Philippe Dufresne's investigation under PIPEDA, the federal private-sector privacy law, will look at the security safeguards the company had in place at the time and whether its notifications to affected people were adequate.

What we don't know yet

Neither the company nor the commissioner has said how many Canadians are affected or which Canadian businesses used the service. BleepingComputer reported that it remained unclear how the data was taken. The FBI has said it is looking into the incident, and several proposed class actions have been filed in Louisiana.

What to do

• If you have shown ID at venues that scan licences, watch for notices from those businesses or from IDScan.net.
• Check your credit report with Equifax and TransUnion and consider placing a fraud alert if you suspect misuse.
• Be wary of messages that reference your licence details or ask you to "verify" your identity.
• Report identity fraud to your local police and the Canadian Anti-Fraud Centre.