What May Have Leaked in the Driver's Licence Breach and How to Protect Yourself
A dark-web service claiming to sell millions of scanned driver's licences has put North American identity protection on alert. The Royal Canadian Mounted Police says it is aware of an ongoing FBI investigation into the report, which suggests hackers obtained tens of millions of government-issued identity records, including Canadian driver's licences.
A Dark-Web Cache of IDs
Independent journalist Brian Krebs said he found a dark-web service called Nexus advertising digital scans of licences from the United States and Canada. The operator claimed to hold tens of millions of licences, millions of other identification cards and travel documents, and hundreds of thousands of medical records. Krebs put the overall figure at roughly 153 million stolen identity documents. That number has not been independently verified, and it likely includes records that are old or no longer valid.
The Role of IDScan.net
The public focus has fallen on IDScan.net, a company whose cloud accounts store scanned identity documents for businesses. On September 4, IDScan.net posted a statement saying that around September 1 it became aware of data that may have been accessed without authorization. The company said an unauthorized third party may have accessed or copied certain customer information stored in its cloud accounts.
That statement did not confirm that the Nexus cache came from IDScan.net's systems. It described a possible intrusion and an ongoing review. No public statement has confirmed a definitive link.
Why a Scanned Licence Is Valuable
A scanned driver's licence is more than a photo ID. It typically contains a name, date of birth, address, licence number, and in many cases a signature and a digital image of the holder. Criminals can use those details to impersonate a victim, open financial accounts, apply for loans, or pass identity checks. A driver's licence number cannot be changed like a password, and replacing a licence does not guarantee that the original data stops circulating. That makes this type of leak harder to contain than a stolen credit-card number.
Practical Steps to Reduce the Damage
Canadians should treat the report as a warning to tighten their identity protections. Standard precautions include:
- Watch for unsolicited texts, emails, or calls that reference your licence or any company you may have used for ID scanning.
- Check your credit reports at both Equifax and TransUnion for accounts or inquiries you do not recognize.
- Contact your provincial driver-licensing authority if you believe your licence was exposed.
- Report suspected identity fraud to your local police and the Canadian Anti-Fraud Centre.
- Consider a credit freeze, which blocks new credit applications in your name.
People should also ask businesses why they need a scanned licence and how long they keep that data. Reducing the number of copies of a licence in circulation lowers the chance that one of them ends up for sale.
What Remains Unknown
Investigators have not said how many Canadian records are in the leaked data, whether all of it came from IDScan.net, or how the alleged intrusion happened. The RCMP says it is monitoring the situation, and the FBI investigation is still open. Until authorities confirm the scope, identity theft protection is the main defence available to the public.
Summary: This article explains what investigators know about the reported North American driver's licence breach tied to IDScan.net, what the dark-web data could mean for Canadians, and practical steps to reduce the risk of identity fraud.