Canadian regulator opens probe of IDScan for allegedly violating data privacy laws

Privacy Commissioner of Canada Philippe Dufresne has launched a probe of IDScan.net in the wake of reports that a bad actor penetrated company databases to steal personal data and scans of 153 million people's drivers’ licenses.

IDScan.net’s technology is widely used by industry — particularly in the retail and hospitality sectors — to verify official IDs.

The investigation, announced Monday, will probe IDScan’s security practices and whether victim notifications were adequate under Canada’s federal private-sector privacy law, the regulator said in a press release.

On September 4, the identity verification company announced hackers obtained user data held in its cloud platform, but did not say how many customers were affected. The statement came amid a series of reports asserting that the breach exposed driver’s licenses belonging to tens of millions.

IDScan learned of the breach on or around September 1, hours after journalist Brian Krebs revealed the scans were on sale on the dark web.

The identity verification company did not respond to a request for comment.

The investigation is ongoing.