Canada’s privacy czar seeking information in massive driver’s licence hack

Canada’s federal privacy commissioner office is “aware” and “engaged with the company” hit by a recent massive hack that appears to have exposed the driver’s licence data of millions of North Americans.

“The Office of the Privacy Commissioner of Canada (OPC) is aware of this matter and is engaged with the company to obtain more information, [and] ensure that it is aware of its obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law, and determine next steps,” said the commissioner’s office in a statement to Global News.

According to the PIPEDA: “An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.”

Story continues below advertisement

Examples of “significant harm” under that legislation include, but are not limited to “financial loss, identity theft, negative effects on the credit record.”

The spokesperson for the federal privacy commissioner was not able to confirm other specifics to Global News, and it is still not clear how many Canadians may have had their personal information exposed, including driver’s licences.

This comes after the RCMP confirmed to Global News earlier this week that it is “monitoring” the situation” and remain engaged with domestic and international law enforcement and cybersecurity partners as appropriate.”

Law enforcement officials haven’t named the company hit by the hack, but it has been widely reported to be IDScan.net after independent cyber security journalist Brian Krebs said he had discovered a dark web site selling digital scans of millions of driver’s licences from people in the U.S. and Canada. He said he confirmed the authenticity of the data being sold with nine people, Reuters reported.

Global News has not independently verified his data and neither the RCMP nor the Canadian Centre for Cyber Security said whether the numbers were accurate, but Krebs pegged the figures at roughly 153 million stolen identity documents from people in the United States and Canada.

Krebs said refining the search for Canadian drivers licences yielded about 1.1 million results.

In a brief statement on Sept. 2, the U.S. FBI said it was “looking into the incident” but could not comment “due to the ongoing nature of the investigation.”

Story continues below advertisement

The source of the identify documents has not been confirmed by officials but Krebs quoted a representative of New Orleans-based identity verification provider IDScan.net as saying that it was investigating the matter.

On Sept. 4, IDScan.net had posted a statement saying that on or around Sept. 1, it became aware of data that may have been accessed without authorization.

It then “determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud.”

4:57 ‘Unprecedented’: OpenAI goes rogue, hacks into another AI company during cybersecurity test

Global News sent an initial request on Tuesday, and a follow-up on Thursday to IDScan.net asking if it knows how many Canadians may have had their data, IDs or other information compromised.

Get breaking National news

Get breaking Canada news delivered to your inbox as it happens so you won't miss a trending story.

A spokesperson acknowledged receipt of both requests but did not provide a response.

Story continues below advertisement

Global News has asked RCMP, the Canadian Cyber Security Centre, and nearly a dozen provincial and federal government officials whether those numbers are accurate, but none have been able to provide a tally of the number of Canadians impacted.

Global News sent a request to the Prime Minister’s Office (PMO) asking if Prime Minister Mark Carney or anyone in his caucus had their information exposed. A spokesperson for Public Safety Minister Gary Anandasangaree responded after the PMO deferred the request to them and said, “we will not be commenting on an ongoing investigation,” noting that was in reference to the FBI’s work.

The RCMP has not confirmed whether any investigation is currently underway in Canada, although the FBI in the U.S. has said it is “looking into the incident.”

Similar requests were also sent to opposition party leaders.

Story continues below advertisement

The Conservative Party, NDP, and Bloc Quebecois did not respond to a request for comment.

“The Green Party of Canada has just been made aware of the reported breach. While neither Elizabeth May nor anyone in the Green Party has been affected, we are deeply concerned about the exposure of North Americans’ personal data and believe that all available measures should be considered to protect Canadians and their personal information,” said a Green Party spokesperson in a statement.

Multiple provincial and territory authorities that handle drivers licence registrations and renewals also responded to requests from Global News, but none were able to confirm how many people in their respective regions may have had their data compromised.

1:42 Canadian agencies ill-equipped to tackle growing cybercrime threat, auditor general finds

The breach could be one of the largest digital breaches of driver’s licence data in North American history, and with millions of people potentially having their sensitive data exposed, experts are urging everyone to be vigilant and aware of bad actors that could exploit that information.

Story continues below advertisement

IDScan.net said in its statement that those who may have been exposed to its breach will be contacted directly, and are being provided with access to free credit monitoring and identity protection services.

The breach means Canadians are especially at risk of falling victim to identity fraud and financial scams.

“Having actual driver’s licences out there is very, very risky because this is actually an ID: proof that is used for when you go to open a bank account, open a credit card, etc,” says Gururaj Saileshwar, a professor of cyber security and computer science at the University of Toronto.

“If somebody could get your driver’s licence, they could impersonate you and cause real harm, financial harm, identity theft, things like that. So the risk is very real, and given the size of the data breach, a large volume of people are affected.”

Saileshwar says that although this particular breach potentially exposed millions of peoples’ data, including driver’s licences, all Canadians should adopt safe habits and best practices online regardless if they are notified by IDScan.net, because most peoples’ personal information has likely been leaked online at one point or another.

“If you see an account that’s being opened for you, like a credit card that’s been opened for you, it’s important to take action and keep monitoring your credit scores,” says Saileshwar.

Story continues below advertisement

“If you are not looking to either apply for a loan or apply for a credit card, it’s probably a good practice to just freeze your credit so that there aren’t unauthorized accounts opened on your behalf.”

Saileshwar also says this breach signals that businesses need to do more to bolster their cyber defences as these breaches become more common.

“There really needs to be better security measures adopted, best practices adopted. Things like not storing data beyond what you need and making sure you’re having good access control and authorization for all of the sensitive data,” he says.

“Regulators and governments also need to make sure that the right regulations are in place, the right laws are in place to make sure companies are doing the due diligence both proactively and reactively in the event of these data breaches.”

“This isn’t going to be the last data breach. We’re only going to see more and more of these and we should make sure that we are learning from this and improving.”

Are you a Canadian who has been notified that your driver’s licence or other data may have been exposed during the IDScan.net cyber breach? We want to hear from you. Use the contact form below to let us know.