Canada’s privacy commissioner has opened an investigation into a massive cyber breach from earlier this month believed to have exposed the personal information of millions of North Americans, including Canadians’ driver’s licences.
The Office of the Privacy Commissioner (OPC) announced the investigation late Monday, which comes after the office confirmed last week to Global News that it was “aware” of the incident and “engaged with the company,” IDScan.net, which was targeted by the attack.
“Privacy Commissioner of Canada Philippe Dufresne has opened an investigation into a data breach at IDScan.net following reports that an unauthorized third party gained access to the company database and stole personal information, including digital scans of driver’s licences and other types of identification (ID),” said the privacy commissioner’s office.
“The investigation will examine the security safeguards that IDScan.net had in place at the time of the breach, as well as the adequacy of its notifications to affected individuals, to determine its compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law.”
IDScan.net, the statement explains, is an online platform used by businesses to verify customers’ government-issued ID, and some examples of businesses that may use these tools include hospitality and nightlife establishments, among others.
According to the PIPEDA: “An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.”
Get breaking National news
Get breaking Canada news delivered to your inbox as it happens so you won’t miss a trending story.
Examples of “significant harm” under that legislation include, but are not limited to “financial loss, identity theft, negative effects on the credit record.”
The privacy commissioner’s office adds that it will continue to engage with IDScan.net “to ensure that the organization is taking the necessary steps to address the incident and mitigate any risks to Canadians.”
The announcement from the office also marks the first time a Canadian agency has confirmed an active investigation into this cyber breach, and after the RCMP said last week that it was “monitoring” the situation” and remained “engaged with domestic and international law enforcement and cybersecurity partners as appropriate.”
According to a statement from IDScan.net on Sept. 4, the attack targeted its cloud networks where customers’ driver’s licence data and other information was being stored.
“While the investigation is ongoing, IDScan.net has determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud. The types of information contained within the affected data may include full names and driver’s license or other government-issued identification numbers,” said IDScan.net in the statement.
The company said those who may have been exposed to its breach will be contacted directly, and are being provided with access to free credit monitoring and identity protection services.
So far, neither the company nor any government agency in Canada or the U.S. have been able to confirm the number of individuals that may have had their data exposed, and law enforcement officials, including the RCMP, haven’t named the company hit by the hack.
Global News sent multiple requests to IDScan.net last week asking if it was aware of how many Canadians were impacted by the breach. A spokesperson acknowledged receipt of those requests but has not provided a response as of publication.
In a brief statement on Sept. 2, the U.S. FBI said it was “looking into the incident” but could not comment “due to the ongoing nature of the investigation.”
Independent cyber security journalist Brian Krebs said in a post from Sept. 1 that he had discovered a dark web site selling digital scans of millions of driver’s licences from people in the U.S. and Canada. He said he confirmed the authenticity of the data being sold with nine people, Reuters reported.
Global News has not independently verified his data and neither the RCMP nor the Canadian Centre for Cyber Security said whether the numbers were accurate, but Krebs pegged the figures at roughly 153 million stolen identity documents from people in the United States and Canada.
Krebs said refining the search for Canadian driver’s licences yielded about 1.1 million results.
The source of the identify documents has not been confirmed by officials but Krebs quoted a representative of New Orleans-based identity verification provider IDScan.net as saying that it was investigating the matter.
– with files from Reuters.
Are you a Canadian who has been notified that your driver’s licence or other data may have been exposed during the IDScan.net cyber breach? We want to hear from you. Use the contact form below to let us know.
© 2026 Global News, a division of Corus Entertainment Inc.
