Regulation
Canada's Privacy Commissioner probes IDScan over breach of 153 million driver's license scans
By Insurance Wire Staff, . Insurance Wire.
Canada's Privacy Commissioner Philippe Dufresne has launched a formal investigation into IDScan.net, the identity verification company whose cloud platform was breached to expose driver's license scans belonging to 153 million people, according to The Record, which broke the story Monday.
The Record reports that the investigation will examine two things: whether IDScan's security practices met the requirements of Canada's federal private-sector privacy law, and whether the company gave adequate notification to people whose data was taken. IDScan announced the breach on September 4, according to The Record, but did not disclose how many customers were affected. The company learned of the intrusion on or around September 1, hours after journalist Brian Krebs reported that the stolen scans were being sold on the dark web, The Record notes.
IDScan.net's technology is widely used in retail and hospitality to verify official identification documents, which means the exposure is not limited to a single sector or customer base. The breach affects individuals whose driver's licenses were scanned by any business running IDScan's platform, not just the businesses themselves.
The Privacy Commissioner's office did not specify a timeline for the investigation. IDScan did not respond to a request for comment, according to The Record.
The regulatory gap between when IDScan learned of the breach and when it publicly disclosed it is likely to be central to the investigation. Canada's federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act, requires organizations to notify both the Privacy Commissioner and affected individuals of breaches that pose a real risk of significant harm. Whether a multi-day delay between discovery and disclosure satisfies that standard is precisely the kind of question a formal probe is designed to answer.
For carriers writing cyber liability or technology errors and omissions coverage, the IDScan breach illustrates a risk that is easy to underweight: downstream exposure through a vendor whose product sits inside thousands of client operations. A single compromised identity verification platform can generate notification obligations, regulatory investigations, and potential claims across an entire industry vertical simultaneously. The hospitality and retail sectors, which The Record identifies as IDScan's primary markets, tend to carry lighter cyber coverage than financial services, which may affect how claims from affected businesses ultimately resolve.
No official reports yet establish which specific insurers carry IDScan's own cyber coverage, what limits are in place, or whether any claims have been filed. The Privacy Commissioner's findings, when they come, will set a benchmark for what Canadian regulators consider adequate security and notification practice in the identity verification space, a benchmark that will matter to underwriters assessing similar vendors going forward.
Source: https://therecord.media/canadian-regulator-opens-probe-of-idscan-following-data-breach
Insurance Wire provides news and information, not insurance, legal, or financial advice. Consult a qualified professional about your specific needs.