News release

Privacy Commissioner of Canada launches investigation into a data breach involving stolen identification details

September 21, 2026 – Gatineau, Quebec

Privacy Commissioner of Canada Philippe Dufresne has opened an investigation into a data breach at IDScan.net following reports that an unauthorized third party gained access to the company database and stole personal information, including digital scans of driver’s licences and other types of identification (ID).

IDScan.net’s technology is used by businesses such as hospitality and nightlife establishments, among others, to verify customers’ government-issued identification.

The investigation will examine the security safeguards that IDScan.net had in place at the time of the breach, as well as the adequacy of its notifications to affected individuals, to determine its compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law.

IDScan.net issued a public advisory about the incident earlier this month. Since that time, the Office of the Privacy Commissioner of Canada (OPC) has been actively engaging with IDScan.net, and will continue to do so, to ensure that the organization is taking the necessary steps to address the incident and mitigate any risks to Canadians.

As the matter involves an active investigation, the OPC is not in a position to provide further details at this time.

Media contact

Office of the Privacy Commissioner of Canada
communications@priv.gc.ca