Is my Ontario driver's licence in the alleged 153-million IDScan.net breach? Here's what Canadians can do to check - Toronto Star

IDScan.net added an online inquiry form for people concerned about the 'security incident,' but experts warn there is no instant way to confirm if a licence was compromised. 

Ontario driver’s licences are among more than 153 million records allegedly leaked and sold on the dark web following a breach of identity verification company IDScan.net.

People concerned about the IDScan.net breach, which allegedly exposed 153 million driver’s licences in Canada and the U.S., can submit an online inquiry to find out whether their information was involved. 

However, unlike Have I Been Pwned, which shows instant confirmation for breaches in its database, IDScan.net’s process is not a self-search portal. Individuals are asked to submit a form to IDScan.net and wait for the company to review its records and respond.  

Those who do not wish to send a form can also retrace where they had their licences scanned or copied and contact the businesses directly. 

Two Canadian cybersecurity experts share what individuals can do while waiting for confirmation, how to stay safe, and the possible next steps for Canadians who may have been part of the breach. 

ID verification company IDScan.net has updated its contact page to include an option for individuals to submit an inquiry about “a security incident.”

Individuals will be led to answer a form that says: “If you’re concerned that your information may have been involved in a security incident, submit your details below, and our team will review our records and follow up.” 

IDScan.net’s security incident inquiries form. 

The online form does not indicate how long individuals can expect to wait for a response. 

In the notice shared by the company on Sept. 4, IDScan.net said the company is notifying potentially impacted individuals and providing access to free credit monitoring and identity protection services. 

“If you have questions about this incident or would like to enrol in the credit monitoring and identity protection services, please call 1-833-516-2980, Monday through Friday, between 8 a.m. and 8 p.m. ET, excluding holidays,” the notice said. 

Metroland Media reached out to IDScan.net to inquire about the timeline for receiving responses after an inquiry has been sent and to confirm if the company has started notifying impacted individuals as well as for Canada-specific notification information but the company has not yet responded. 

Metroland Media also reached out to the number indicated in the IDScan.net notice. An agent confirmed that individuals can use the form on the company’s website to submit an inquiry about the breach, but said no immediate confirmation should be expected as the investigation is still ongoing.

IDScan.net is an identity verification and fraud prevention platform used by businesses and organizations to scan and verify government-issued IDs. The service is widely used across industries including retail, education, law enforcement, shipping and banking, among others. 

According to its website, the company performs more than 21 million ID verifications every month at more than 20,000 locations around the world.

As of the time of writing, there is still no verified public lookup, similar to Have I Been Pwned, that Canadians can use to instantly confirm whether their licence was exposed in this breach. 

“The frustrating answer is that there’s no reliable way for someone to look themselves up via their license number right now,” Dave Nelson, Manitoba-based senior director of threat labs research and response at cybersecurity company Malwarebytes, told Metroland Media. 

Nelson warned individuals against using websites claiming to have a database and portal where people can self-search. 

“I’d be very cautious about any website claiming to offer one, because scammers love to set up fake ‘check if you were affected’ pages after big breaches to collect even more personal information,” he said. 

In a previous interview with Metroland Media about the breach, Ontario cybersecurity expert Ali Dehghantanha, Canada research chair in cybersecurity and threat intelligence and professor at the University of Guelph, also warned individuals about criminals who may launch phishing attacks to exploit the situation. 

“Criminals may send messages saying, ‘your driver’s licence was compromised — click here to verify your identity,’” he said.

People should not follow links or call numbers in unsolicited breach notifications and instead go to the organization’s official website or contact it using official channels. 

While waiting for official notification, experts also advise proactively retracing where the licence was submitted, scanned, photographed or copied. 

Toronto-based cybersecurity expert Edward Kiledjian, whose cybersecurity work for many Canadian firms spans over 20 years, told Metroland Media individuals can also contact the business they think may have scanned, photographed or copied the licence. 

“I would contact the business’s privacy officer or ask customer service to refer the inquiry to someone responsible for privacy,” he said. 

Individuals can ask whether the business retained an image of their licence or information from it, whether IDScan.net processed or stored that information directly or through another provider, and whether their records were involved, he added. 

“If the business cannot yet answer, they should ask how and when they will receive an update,” he said. 

A business use of IDScan.net does not establish that every customer was affected and an unresolved status is not a confirmation that someone’s information was safe, Kiledjian explained. 

He believes the business that collected the licence scans should remain part of the conversation. 

“Where Canada’s federal private-sector privacy law applies, transferring personal information to a service provider for processing does not remove the organization’s accountability for it,” Kiledjian said. 

Kiledjian said individuals, however, do not need to wait for a notification before taking steps to protect themselves. 

• Review both Canadian credit reports. Free reports are available from Equifax Canada and TransUnion Canada without a paid subscription. Individuals should check for unfamiliar accounts, inquiries and changes to personal information, and continue checking periodically. A clean report does not prove that identity information was never exposed, he said. 

• Consider credit protections. Ontario and Quebec residents can place free credit freezes or locks, separately with Equifax and TransUnion. These restrict access to credit information for specified purposes and can help prevent fraudulent credit applications. However, they do not prevent every form of identity misuse and may need to be lifted for a legitimate credit application. Individuals elsewhere should ask both bureaus about fraud alerts, which flag possible fraud but do not freeze access to the file, Kiledjian advised. 

Kiledjian urges those who receive confirmation that their licences were exposed and those who believe their licence information has been misused to contact their provincial or territorial authority that issued the licence. 

“Ask whether replacement or other measures are appropriate, whether the licence number would change and what protection that would provide,” he advised. 

However, replacing the card should not be assumed to resolve the exposure, he said.