Canada’s privacy czar seeking information in massive driver’s licence hack

Canada’s federal privacy commissioner office is “aware” and “engaged with the company” hit by a recent massive hack that appears to have exposed the driver’s licence data of millions of North Americans.

According to the PIPEDA: “An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.”

Examples of “significant harm” under that legislation include, but are not limited to “financial loss, identity theft, negative effects on the credit record.”

The spokesperson for the federal privacy commissioner was not able to confirm other specifics to Global News, and it is still not clear how many Canadians may have had their personal information exposed, including driver’s licences.

This comes after the RCMP confirmed to Global News earlier this week that it is “monitoring” the situation ” and remain engaged with domestic and international law enforcement and cybersecurity partners as appropriate.”

Law enforcement officials haven’t named the company hit by the hack, but it has been widely reported to be IDScan.net after independent cyber security journalist Brian Krebs said he had discovered a dark web site selling digital scans of millions of driver’s licences from people in the U.S. and Canada. He said he confirmed the authenticity of the data being sold with nine people, Reuters reported.

Global News has not independently verified his data and neither the RCMP nor the Canadian Centre for Cyber Security said whether the numbers were accurate, but Krebs pegged the figures at roughly 153 million stolen identity documents from people in the United States and Canada.

Krebs said refining the search for Canadian drivers licences yielded about 1.1 million results.

In a brief statement on Sept. 2, the U.S. FBI said it was “looking into the incident” but could not comment “due to the ongoing nature of the investigation.”

The source of the identify documents has not been confirmed by officials but Krebs quoted a representative of New Orleans-based identity verification provider IDScan.net as saying that it was investigating the matter.

On Sept. 4, IDScan.net had posted a statement saying that on or around Sept. 1, it became aware of data that may have been accessed without authorization.

It then “determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud.”

Global News sent an initial request on Tuesday, and a follow-up on Thursday to IDScan.net asking if it knows how many Canadians may have had their data, IDs or other information compromised.

A spokesperson acknowledged receipt of both requests but did not provide a response.