Canada's Privacy Watchdog Is Investigating Equifax

Update: On Monday, October 2, Equifax announced that the number of Canadians affected by the hack is 8,000, down from an earlier estimate of 100,000. The total number of affected US individuals also changed, with Equifax stating that 145.5 million people in the US were affected, up from the initially stated total of 143 million.

Update: On Friday, the Office of the Privacy Commissioner (OPC) of Canada announced that it is launching an investigation into the hack that targeted credit giant Equifax. To date, Equifax has not stated how many Canadians are affected.

OPC additionally stated that "at this point in time, it is not clear that the affected data was limited to Canadians with US dealings," although earlier reports had stated otherwise. Equifax has committed to notifying all impacted Canadians in writing as soon as possible, the OPC statement says, and will offer free credit monitoring.

One week after credit firm Equifax revealed a massive hack affecting half of the American population, Canadians are still waiting to hear how many of us are affected.

After announcing the hack on September 7, the credit giant was immediately forthcoming about how many Americans were affected—143 million—but in its initial statement it was incredibly vague on how many Canadians and UK citizens were involved. The company simply said that "limited" information from "certain" UK and Canadian citizens was stolen. On Friday, the Canadian Press reported that the Canadian Automobile Association (CAA) notified 10,000 members who participated in a joint CAA and Equifax program that their data may have been compromised. The program started in March of 2015 and ran until July 1 of this year.

Read More: More Like Social Insecurity Number, Amirite?

Equifax still hasn't publicly revealed any meaningful details about how many Canadians are at risk thanks to the hack, which began in May and was detected in July. The CBC reports that Equifax has been telling concerned Canadian callers that only those who have had "dealings" with the US (travel, business, etc.) are likely to be compromised. The UK is playing a similar waiting game with Equifax. The Telegraph reported that the company holds the personal information of 44 million UK residents and the country's information commissioner is investigating, but ultimately nobody knows what's going on.

Equifax Canada did not immediately respond to Motherboard's request for comment.

Equifax's disorganized response to the hack has been a point of frustration for many Americans, but it's nothing compared to what's happened in Canada. There is currently no website for people to check if their details were compromised, like there is for US customers. The company only got in touch with the Office of the Privacy Commissioner (OPC)—Canada's federal privacy watchdog, which investigates breaches—after Canadian authorities contacted Equifax the day after the company announced the hack to the public. That was already more than three months after the hack itself occurred.

According to OPC spokesperson Valerie Lawton, whom Motherboard reached over email, the office has requested a full report from Equifax, including details on how Canadians were affected by the breach. In a statement posted online, the OPC further stated that it is "urging" Equifax to set up a way for Canadians to check if they've been affected.

"Given the potential sensitivity of the information, we expect that Equifax will adopt measures to help affected individuals," Lawton wrote in an email.

But when?

Get six of our favorite Motherboard stories every day by signing up for our newsletter.

UPDATE: This article's headline has been updated to reflect new information, and an update was added to the top of the article.