Full Breakdown
Privacy Commissioner Launches Probe into Massive IDScan.net Data Breach
By Drooid · · How we work
Core Event
The Office of the Privacy Commissioner of Canada (OPC) has opened a formal investigation into a large-scale cyber breach at IDScan.net, a cloud-based platform that stores digital scans of government-issued identification for businesses. The breach is believed to have exposed personal information—including full names and driver’s licence numbers—of millions of individuals in Canada and the United States.
Background & Context
IDScan.net provides verification services to hospitality, nightlife and other sectors that require proof of identity. The company reported that an unauthorized third party accessed its cloud environment, potentially copying customer data stored there. This follows a pattern of increasing cyber incidents targeting Canadian private-sector firms, prompting heightened scrutiny from law-enforcement and privacy regulators.
Official Statements & Responses
- The privacy commissioner’s office announced that the investigation will assess IDScan.net’s security safeguards and the adequacy of its notifications under the Personal Information Protection and Electronic Documents Act (PIPEDA).
- IDScan.net said it is contacting potentially affected customers and offering free credit-monitoring and identity-protection services.
- The Royal Canadian Mounted Police (RCMP) confirmed it is monitoring the situation and working with domestic and international partners, but has not disclosed the number of Canadians affected.
- The U.S. Federal Bureau of Investigation (FBI) indicated it is looking into the incident but declined further comment due to the ongoing nature of the probe.
Data & Statistics
Independent cybersecurity journalist Brian Krebs reported that a dark-web marketplace was offering digital scans of roughly 153 million identity documents from the United States and Canada. His analysis of the listings suggested about 1.1 million of those records were Canadian driver’s licences. Neither the RCMP nor the Canadian Centre for Cyber Security has verified these figures.
Verbatim Quotes
- “Privacy Commissioner of Canada Philippe Dufresne has opened an investigation into a data breach at IDScan.net following reports that an unauthorized third party gained access to the company database and stole personal information, including digital scans of driver’s licences and other types of identification (ID),” — the privacy commission
- “While the investigation is ongoing, IDScan.net has determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud. The types of information contained within the affected data may include full names and driver’s license or other government-issued identification numbers,” — IDScan.net
