Breach · · 4 min read
The IDScan.net breach: what a leak of scanned IDs means for Canadians
IDScan.net says someone was inside part of its cloud for five months. The data could include driver’s licence and passport details scanned at bars, casinos and car rentals.
If you’ve had your driver’s licence scanned at the door of a bar, a casino or a car rental counter, there’s a chance it went through software from IDScan.net. On October 16, 2026, the company published a notice for people in Canada about a security incident, and Canada’s privacy commissioner has been investigating it since September. Here’s what’s known, and what’s worth doing.
What happened
IDScan.net sells ID verification tools that businesses use to check government-issued identification. According to its notice to individuals in Canada, the company learned on or around September 1, 2026 that some data may have been accessed without permission. Its investigation so far found that an unauthorized third party had access to part of its cloud environment between April 4 and September 2, 2026, and that the incident was limited to its VeriScan platform. The investigation is still ongoing.
The information potentially involved could include a combination of:
- full name and contact information
- date of birth
- driver’s licence, passport and other government ID numbers
Not every person had every field exposed. IDScan.net says what was stored depended on how each business used VeriScan and what it chose to collect.
On September 21, the Office of the Privacy Commissioner of Canada opened an investigation into the breach, citing reports that digital scans of driver’s licences and other ID were stolen. It will look at the safeguards IDScan.net had in place and whether its notifications to affected people were adequate under PIPEDA.
CBC News reported that the FBI had confirmed it was looking into the reported sale of tens of millions of U.S. and Canadian driver’s licences on the dark web, two days before IDScan.net published its first alert. The company hasn’t published a count of affected people, and we haven’t seen one confirmed by a regulator, so we’re not repeating estimates here.
What this means for you
You probably can’t tell from memory whether a business you visited used VeriScan. That’s the uncomfortable part of this kind of breach: you never chose IDScan.net, and you may never have heard of it.
A leaked ID number isn’t like a leaked password. You can’t change your date of birth, and replacing a licence or passport takes time. What a criminal can do with it is try to pass as you, for example to open an account or to make a phone call to your bank sound convincing. That’s why the most useful steps are the ones that make your name harder to borrow, not the ones that change a password.
What you can do
- Call the number in the official notice, not one in an email. IDScan.net is offering free credit monitoring and identity protection. The notice gives 1-833-516-2980 (Monday to Friday, 8 a.m. to 8 p.m. ET). Messages that “confirm” you’re affected and ask you to click a link deserve extra suspicion right now.
- Put a fraud warning on your credit file. The notice points to Equifax Canada (1-800-465-7166) and TransUnion (1-800-663-9980). It describes a “Potential Fraud Warning” that asks lenders to contact you before granting credit, and says it stays on your file for six years. Our after-a-breach checklist explains credit locks and alerts in more detail.
- Check your credit report. Look for accounts or inquiries you don’t recognize. The notice says you can ask either bureau for your report by mail, by phone or in person.
- Protect your phone number. Someone with your name, birth date and ID number has more to work with when trying to move your number to their SIM. Our SIM swap guide covers adding a PIN with your carrier.
- Be careful with “verification” calls. A caller who already knows your date of birth and licence number can sound official. Hang up and call the organization back on a number you found yourself. See how scammers use leaked data.
If you’re unsure whether you were affected, you can ask IDScan.net at the number above. You can also raise a concern with a business that scanned your ID and ask what software it used and how long it keeps the scans.
How Frame helps
Frame keeps a catalog of known breaches and lets you add the ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist, and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.
Sources
- IDScan.net, Notice of Security Incident for Individuals in Canada, October 16, 2026
- Office of the Privacy Commissioner of Canada, Privacy Commissioner of Canada launches investigation into a data breach involving stolen identification details, September 21, 2026
- CBC News, Canadian investigation launched into data breach that exposed millions of IDs, September 21, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.