Canada’s federal privacy commissioner office is “aware” and “engaged with the company” hit by a recent massive hack that appears to have exposed the driver’s licence data of millions of North Americans.
asserted
that → engage → Americans
“The Office of the Privacy Commissioner of Canada (OPC) is aware of this matter and is engaged with the company to obtain more information, ensure that it is aware of its obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law, and determine next steps,” said the commissioner’s office in a statement to Global News.
asserted
office → engage → News
According to the PIPEDA: “An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.”
Examples of “significant harm” under that legislation include, but are not limited to “financial loss, identity theft, negative effects on the credit record.”
The spokesperson for the federal privacy commissioner was not able to confirm other specifics to Global News, and it is still not clear how many Canadians may have had their personal information exposed, including driver’s licences.
uncertain
information → accord → licences
This comes after the RCMP confirmed to Global News earlier this week that it is “monitoring” the situation” and remain engaged with domestic and international law enforcement and cybersecurity partners as appropriate.”
Law enforcement officials haven’t named the company hit by the hack, but it has been widely reported to be IDScan.net after independent cyber security journalist Brian Krebs said he had discovered a dark web site selling digital scans of millions of driver’s licences from people in the U.S. and Canada.
asserted
he → come → U.S.
He said he confirmed the authenticity of the data being sold with nine people, Reuters reported.
asserted
Reuters → say → people
Global News has not independently verified his data and neither the RCMP nor the Canadian Centre for Cyber Security said whether the numbers were accurate, but Krebs pegged the figures at roughly 153 million stolen identity documents from people in the United States and Canada.
Krebs said refining the search for Canadian driver’s licences yielded about 1.1 million results.
uncertain
refining → verify → results
In a brief statement on Sept. 2, the U.S. FBI said it was “looking into the incident” but could not comment “due to the ongoing nature of the investigation.”
uncertain
it → say → investigation
The source of the identify documents has not been confirmed by officials but Krebs quoted a representative of New Orleans-based identity verification provider IDScan.net as saying that it was investigating the matter.
asserted
it → confirm → matter
On Sept. 4, IDScan.net had posted a statement saying that on or around Sept. 1, it became aware of data that may have been accessed without authorization.
uncertain
that → post → authorization
It then “determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud.”
uncertain
party → determine → cloud
Global News sent an initial request on Tuesday, and a follow-up on Thursday to IDScan.net asking if it knows how many Canadians may have had their data, IDs or other information compromised.
uncertain
data → send → IDScan.net
Get daily National news
A spokesperson acknowledged receipt of both requests but did not provide a response.
asserted
spokesperson → get → response
How many Canadians are impacted?
asserted
Canadians → impact → ?
Global News has asked RCMP, the Canadian Cyber Security Centre, and nearly a dozen provincial and federal government officials whether those numbers are accurate, but none have been able to provide a tally of the number of Canadians impacted.
asserted
none → ask → Canadians
Global News sent a request to the Prime Minister’s Office (PMO) asking if Prime Minister Mark Carney or anyone in his caucus had their information exposed.
asserted
information → send → caucus
A spokesperson for Public Safety Minister Gary Anandasangaree responded after the PMO deferred the request to them and said, “we will not be commenting on an ongoing investigation,” noting that was in reference to the FBI’s work.
asserted
that → respond → work
The RCMP has not confirmed whether any investigation is currently underway in Canada, although the FBI in the U.S. has said it is “looking into the incident.”
asserted
it → confirm → incident
Similar requests were also sent to opposition party leaders.
asserted
requests → send → leaders
The Conservative Party, NDP, and Bloc Quebecois did not respond to a request for comment.
asserted
Party → respond → comment
“The Green Party of Canada has just been made aware of the reported breach.
asserted
Party → make → breach
While neither Elizabeth May nor anyone in the Green Party has been affected, we are deeply concerned about the exposure of North Americans’ personal data and believe that all available measures should be considered to protect Canadians and their personal information,” said a Green Party spokesperson in a statement.
uncertain
spokesperson → affect → statement
Multiple provincial and territory authorities that handle driver’s licence registrations and renewals also responded to requests from Global News, but none were able to confirm how many people in their respective regions may have had their data compromised.
uncertain
data → handle → regions
- What the U.S. Fed hiking rates means for the loonie and for borrowers
- Locals ‘denied a say’ in Saskatchewan AI data centres; NDP calls for moratorium
-
asserted
NDP → hike → moratorium
CPP Investments and Brookfield just launched a $50B Maple Fund.
asserted
Investments → launch → Fund
- Dollarama expects higher sales as inflation-hit shoppers look for discounts
What should Canadians do now?
asserted
Canadians → expect → What
The breach could be one of the largest digital breaches of driver’s licence data in North American history, and with millions of people potentially having their sensitive data exposed, experts are urging everyone to be vigilant and aware of bad actors that could exploit that information.
uncertain
that → have → information
IDScan.net said in its statement that those who may have been exposed to its breach will be contacted directly, and are being provided with access to free credit monitoring and identity protection services.
uncertain
who → say → services
The breach means Canadians are especially at risk of falling victim to identity fraud and financial scams.
asserted
Canadians → mean → fraud
“Having actual driver’s licences out there is very, very risky because this is actually an ID: proof that is used for when you go to open a bank account, open a credit card, etc,” says Gururaj Saileshwar, a professor of cyber security and computer science at the University of Toronto.
asserted
Saileshwar → have → Toronto
“If somebody could get your driver’s licence, they could impersonate you and cause real harm, financial harm, identity theft, things like that.
uncertain
they → get → that
So the risk is very real, and given the size of the data breach, a large volume of people are affected.”
asserted
volume → give → people
Saileshwar says that although this particular breach potentially exposed millions of peoples’ data, including driver’s licences, all Canadians should adopt safe habits and best practices online regardless if they are notified by IDScan.net, because most peoples’ personal information has likely been leaked online at one point or another.
asserted
information → say → point
“If you see an account that’s being opened for you, like a credit card that’s been opened for you, it’s important to take action and keep monitoring your credit scores,” says Saileshwar.
asserted
Saileshwar → see → scores
“If you are not looking to either apply for a loan or apply for a credit card, it’s probably a good practice to just freeze your credit so that there aren’t unauthorized accounts opened on your behalf.”
asserted
it → look → behalf
Saileshwar also says this breach signals that businesses need to do more to bolster their cyber defences as these breaches become more common.
asserted
breaches → say → defences
“There really needs to be better security measures adopted, best practices adopted.
asserted
practices → need → ?
Things like not storing data beyond what you need and making sure you’re having good access control and authorization for all of the sensitive data,” he says.
asserted
he → store → data
“Regulators and governments also need to make sure that the right regulations are in place, the right laws are in place to make sure companies are doing the due diligence both proactively and reactively in the event of these data breaches.”
asserted
doing → need → breaches
“This isn’t going to be the last data breach.
asserted
This → go → ?
We’re only going to see more and more of these and we should make sure that we are learning from this and improving.”
Are you a Canadian who has been notified that your driver’s licence or other data may have been exposed during the IDScan.net cyber breach?
uncertain
licence → go → breach
…and 2 more, not listed.
The Aporia
