Sep 24, 2026
If you have walked into a bar or club, rented a car or visited a retail store recently, an employee may have asked to scan your government-issued photo ID.
While many Canadians assume the scan is a quick digital check to confirm age or identity, that routine step may have exposed your personal details in one of North America’s largest data security incidents.
Advertisement
The Privacy Commissioner of Canada launched a formal investigation into Louisiana-based technology company IDScan.net following reports that an unauthorized third party breached its cloud database, federal officials announced Sept. 21, 2026.
Thanks for subscribing!
The best of Money.ca delivered weekly.
By signing up, you accept Money.ca Terms of Use, Subscription Agreement, and Privacy Policy.
The breach has reportedly exposed more than 153 million driver’s licence records across Canada and the United States, along with millions of other identity documents.
How ID scanning works at bars and businesses
Many patrons are unaware that when a door host or security staff member scans a driver’s licence, the device often does far more than read a date of birth.
IDScan.net provides digital verification software and hardware to thousands of client businesses, including hospitality venues, nightlife establishments, car rental agencies and cannabis retailers.
Instead of visually inspecting a physical card, these ID scanners capture high-resolution images of the front and back of government-issued IDs. They extract precise barcode details, including full legal names, home addresses, dates of birth, licence numbers and physical descriptions. In many instances, the system uploads this information directly to external cloud databases for recordkeeping and verification.
Cybersecurity experts point out that many Canadians have undergone this collection process without realizing their sensitive personal data was being stored on third-party servers outside the country.
Must Read
- Are you paying too much for car insurance? Here are 3 clever ways to slash your monthly bill
- Here are 5 'must-haves' that Canadians constantly overpay for. How many of these are sabotaging your budget every single month?
- Here are the 5 biggest differences between rich and poor Canadians — which side do you fall on?
Join 19,000+ readers and get Money.ca’s best stories and exclusive interviews first — clear insights curated and delivered weekly. Subscribe now.
The scope of the IDScan.net breach
The data security incident came to light after cybersecurity journalist Brian Krebs reported on Sept. 1, 2026, that a listing on the dark web forum Exploit offered searchable access to a massive trove of identity files under the name “Nexus.”
The leaked data reportedly includes:
Advertisement
- More than 153 million Canadian and U.S. driver’s licences
- 10 million government identity cards
- 3 million travel documents and passports
- Over 579,000 medical cards
According to cybersecurity researcher Zach Edwards, who spoke with Reuters, the breach is unprecedented in size and scope for government-issued driver’s licences. Edwards noted the stolen files contain full digital document scans rather than basic text records alone.
In a public security advisory published earlier in September 2026, IDScan.net acknowledged that an unauthorized third party “may have accessed and/or copied certain customer information” stored within account spaces on its cloud platform.
The company stated it took immediate steps to secure its systems, launched an internal review and engaged third-party cybersecurity specialists to assist with an ongoing investigation alongside federal law enforcement agencies such as the FBI.
How Canadian privacy and constitutional laws apply to ID scanning
For many Canadians, having an ID scanned raises basic questions about what private businesses are legally allowed to do.
It is easy to confuse constitutional rights with everyday privacy rules. The Canadian Charter of Rights and Freedoms protects fundamental liberties, such as protection against unreasonable search under Section 8 and freedom of thought, belief and expression under Section 2(b). However, the Charter only binds the government and police. It does not control private businesses like bars, clubs or stores.
Instead, commercial businesses must follow strict statutory privacy rules, as outlined by the Office of the Privacy Commissioner of Canada. The federal Personal Information Protection and Electronic Documents Act (PIPEDA), alongside similar provincial laws in Alberta, British Columbia and Quebec, governs private sector data collection.
Advertisement
Under PIPEDA and corresponding provincial statutes:
- Businesses must get your clear consent before collecting your information
- Data collection must be limited to what is truly necessary for that interaction
- Businesses must secure any data they collect against leaks or theft
- Individuals have the right to ask what information a business holds about them and where it is being sent
While a venue can check your age to ensure safety, privacy regulators have consistently ruled that businesses cannot force you to let them digitally scan and store your card when a simple glance at your ID is enough. Even if a business uses foreign software or stores data on server farms outside Canada, Canadian privacy laws still apply to how your data is collected and protected.
Federal privacy commissioner steps in
Under PIPEDA, organizations collecting personal data from Canadians must maintain reasonable security safeguards and properly notify affected individuals in the event of a breach.
Privacy Commissioner of Canada Philippe Dufresne announced his office opened a regulatory investigation to examine IDScan.net’s security protocols and determine whether its public notification efforts complied with Canadian privacy standards.
Advertisement
The Office of the Privacy Commissioner of Canada (OPC) confirmed it is actively engaging with IDScan.net to mitigate potential risks to Canadians.
Because the investigation remains active, the privacy commissioner’s office declined in their statement to release further specific details regarding affected Canadian populations, though preliminary reports suggest hundreds of thousands of provincial driver’s licences may be involved.
What Canadians should do now
Because scanned driver’s licences contain sensitive personal identifiers and high-resolution document images, privacy experts warn the breach elevates the risk of targeted phishing, identity theft and synthetic identity fraud.
Canadians who suspect their ID may have been scanned at participating businesses can take immediate steps to safeguard their identity:
Monitor financial accounts and credit reports
Request free copies of your credit reports from Canada’s main credit bureaus, Equifax Canada and TransUnion Canada. Check for any unknown credit inquiries, new credit cards or accounts opened without your knowledge.
Enable fraud alerts
Consider placing a fraud alert on your credit file with Equifax and TransUnion. A fraud alert instructs lenders to contact you directly to verify your identity before approving any new credit applications.
Watch for targeted phishing scams
Be cautious of unsolicited text messages, emails or phone calls claiming to be from government agencies, law enforcement, banks or identity protection services. Fraudsters who hold full names, addresses and driver’s licence numbers can craft convincing scams designed to trick victims into revealing social insurance numbers or financial credentials.
Ask before letting businesses scan your ID
Under Canadian privacy guidelines, individuals have the right to ask how their personal information is being handled. The next time a bar, club or retail store requests to scan your card, ask if they can visually inspect the card instead or inquire whether they store scanned card data on external servers.
Know your rights
As Canadians navigate an increasingly digital landscape, understanding what happens to your personal information at the door of a nightspot or retail store is the first step toward self-protection.
Under Canadian privacy standards, individuals maintain rights regarding how their personal details are handled:
- Right to opt for visual inspection: In most casual commercial settings, door staff only require verification of age or identity. You have the right to ask if a staff member can visually inspect your card rather than run it through an electronic scanner.
- Right to inquire about data storage: You can ask a business where scanned card data is stored, how long it is retained and whether it is uploaded to third-party databases outside Canada.
- Right to file a regulatory complaint: If a private business refuses entry solely because you decline an electronic ID scan when visual verification is sufficient, or if they fail to explain their data practices, you can file an official complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy authority.
The routine tap or scan of a driver’s licence at a bar entrance may seem like a minor inconvenience on a night out, but as the IDScan.net incident demonstrates, the downstream risks to your personal identity can last long after the night is over. By exercising your privacy rights at the door, you can take control of your sensitive information before it reaches an unsecured database.
You May Also Like
- This 7-step plan from Dave Ramsey is designed to help you ditch debt, save more and build wealth — here’s how it works
- Prioritize these 4 critical investments and watch your net worth skyrocket
- Here are 8 solid money moves that could free up real cash every month — here's where to start
- Millionaires under 43 are reshaping investing — just 25% of their portfolios are in stocks. Here’s where their money is going
The most expensive financial mistakes are often the ones you don't see coming. Join 19,000+ Canadians who get the money moves, risks and opportunities shaping their finances — delivered free each week. Subscribe now.
Leslie Kennedy served as an editor at Thomson Reuters and for Star Media Group, followed by a number of years as a writer and editor and content manager in marketing communications, before returning to her editorial roots. She is a graduate of Humber College’s post-graduate journalism program and has been a professional writer and editor ever since.
