Canada’s privacy commissioner has opened an investigation into a massive cyber breach from earlier this month believed to have exposed the personal information of millions of North Americans, including Canadians’ driver’s licences.
asserted
commissioner → open → licences
The Office of the Privacy Commissioner (OPC) announced the investigation late Monday, which comes after the office confirmed last week to Global News that it was “aware” of the incident and “engaged with the company,” IDScan.net, which was targeted by the attack.
asserted
which → announce → attack
“Privacy Commissioner of Canada Philippe Dufresne has opened an investigation into a data breach at IDScan.net following reports that an unauthorized third party gained access to the company database and stole personal information, including digital scans of driver’s licences and other types of identification (ID),” said the privacy commissioner’s office.
asserted
office → open → identification
“The investigation will examine the security safeguards that IDScan.net had in place at the time of the breach, as well as the adequacy of its notifications to affected individuals, to determine its compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law.”
asserted
IDScan.net → examine → Act
IDScan.net, the statement explains, is an online platform used by businesses to verify customers’ government-issued ID, and some examples of businesses that may use these tools include hospitality and nightlife establishments, among others.
uncertain
that → explain → others
According to the PIPEDA: “An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.”
uncertain
breach → accord → individual
Get breaking National news
Examples of “significant harm” under that legislation include, but are not limited to “financial loss, identity theft, negative effects on the credit record.”
asserted
Examples → get → record
The privacy commissioner’s office adds that it will continue to engage with IDScan.net “to ensure that the organization is taking the necessary steps to address the incident and mitigate any risks to Canadians.”
asserted
organization → add → Canadians
The announcement from the office also marks the first time a Canadian agency has confirmed an active investigation into this cyber breach, and after the RCMP said last week that it was “monitoring” the situation” and remained “engaged with domestic and international law enforcement and cybersecurity partners as appropriate.”
asserted
it → mark → enforcement
According to a statement from IDScan.net on Sept. 4, the attack targeted its cloud networks where customers’ driver’s licence data and other information was being stored.
uncertain
data → accord → networks
“While the investigation is ongoing, IDScan.net has determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud.
uncertain
party → determine → cloud
The types of information contained within the affected data may include full names and driver’s license or other government-issued identification numbers,” said IDScan.net in the statement.
uncertain
IDScan.net → contain → statement
The company said those who may have been exposed to its breach will be contacted directly, and are being provided with access to free credit monitoring and identity protection services.
uncertain
who → say → services
So far, neither the company nor any government agency in Canada or the U.S. have been able to confirm the number of individuals that may have had their data exposed, and law enforcement officials, including the RCMP, haven’t named the company hit by the hack.
uncertain
officials → confirm → hack
Global News sent multiple requests to IDScan.net last week asking if it was aware of how many Canadians were impacted by the breach.
asserted
Canadians → send → breach
A spokesperson acknowledged receipt of those requests but has not provided a response as of publication.
asserted
spokesperson → acknowledge → publication
In a brief statement on Sept. 2, the U.S. FBI said it was “looking into the incident” but could not comment “due to the ongoing nature of the investigation.”
uncertain
it → say → investigation
Independent cyber security journalist Brian Krebs said in a post from Sept. 1 that he had discovered a dark web site selling digital scans of millions of driver’s licences from people in the U.S. and Canada.
asserted
he → say → U.S.
He said he confirmed the authenticity of the data being sold with nine people, Reuters reported.
asserted
Reuters → say → people
Global News has not independently verified his data and neither the RCMP nor the Canadian Centre for Cyber Security said whether the numbers were accurate, but Krebs pegged the figures at roughly 153 million stolen identity documents from people in the United States and Canada.
Krebs said refining the search for Canadian driver’s licences yielded about 1.1 million results.
uncertain
refining → verify → results
The source of the identify documents has not been confirmed by officials but Krebs quoted a representative of New Orleans-based identity verification provider IDScan.net as saying that it was investigating the matter.
asserted
it → identify → matter
Are you a Canadian who has been notified that your driver’s licence or other data may have been exposed during the IDScan.net cyber breach?
uncertain
licence → notify → breach
We want to hear from you.
asserted
We → want → you
Use the contact form below to let us know.
asserted
us → use → form
The Aporia
