Canada’s federal privacy watchdog has opened a formal investigation into a major data breach at IDScan.net, with unauthorized access potentially exposing driver’s license data for millions of people in Canada and the United States.

The Privacy Commissioner of Canada is assessing whether the breach meets the threshold of creating a real risk of significant harm under PIPEDA, while the investigation continues.

IDScan.net says it is notifying potentially affected individuals and offering free credit monitoring and identity protection services.

The company confirms that exposed individuals will be contacted and provided with free credit monitoring and identity protection options.

The investigation remains ongoing, with no additional details released at this time.

Experts describe the breach as unprecedented in scale and potentially posing national security risks for high-profile individuals.

PIPEDA requires organizations to report breaches that create real risk of significant harm, and regulators are evaluating whether this standard is met.

The OPC is actively engaging with IDScan.net to mitigate risk to Canadians, with the RCMP and U.S. authorities monitoring as investigations proceed.

Media estimates suggest the breach could involve tens to hundreds of millions of identity documents, though official figures have not been confirmed; independent reporting points to a large-scale dark web listing.

The probe will scrutinize IDScan.net’s security safeguards and the adequacy of breach notifications to determine compliance with Canada’s private-sector privacy law.

IDScan.net operates an ID-verification platform used by businesses; the breach reportedly involved data stored in cloud services, potentially including full names and government ID numbers, with unauthorized access occurring around early September 2026.

There are reports that tens of millions of driver’s licenses were being traded on the dark web, with federal investigators probing a Krebs report, though the involved site reportedly disappeared after publication.