The licence scans were sitting at a vendor most people never named

Most people who had their driver's licence copied this month never opened an account at IDScan.net. That is the part that should sit with you. A Louisiana identity-check vendor sits behind rental desks, retailers, and back-office KYC. KrebsOnSecurity found the scans for sale. The company later said an unauthorized party may have copied customer information from its cloud. The FBI's New Orleans office opened a case. The RCMP said it is monitoring. The Canadian Centre for Cyber Security has not blessed the headcount. Treat the numbers as Krebs's reporting, not a government census.

What Nexus advertised

In early September a service calling itself Nexus showed up on the Russian crime forum Exploit. Krebs was the free sample. The listing claimed more than 153 million driver's licences from the United States and Canada, plus ID cards, travel documents, and hundreds of thousands of medical cards. Krebs searched with consent and matched real people. A blank search returned millions of pages. A Canada-only search, in his write-up, returned about 1.1 million licences, with Ontario the largest pile at roughly 474,000. The operators claimed the collection had been growing for over a year. After the story landed, Nexus went dark. That does not put the copies back.

IDScan.net posted that on or around September 1 it learned data may have been accessed without authorization. The later notice named full names and driver's licence or other government ID numbers. The company said it brought in outside help and that the investigation continues. It has not published a clean Canadian count. Clients named in the reporting include firms you have actually stood in front of: Hertz among them. If you rented a car and handed over a licence to be scanned, you did not "sign up for IDScan." The counter did.

What this means in Canada

A licence photo plus a licence number is enough for a convincing fake, a credit application, or a SIM swap story that sounds like you. Ontario having the densest Canadian pile is not a surprise if that is where the vendor's customers did the most scans. It is also not a finding that Alberta or BC were spared. Krebs reported US records as the bulk. Canadian records were still large enough that RCMP put a statement out.

Global News noted that neither the RCMP nor the Cyber Centre confirmed Krebs's totals. That is the right posture. It does not make the incident hypothetical. IDScan itself said customer information on its cloud may have been copied. If your firm uses an ID-scan or KYC API, assume the question is now "where do those images live, and who else can reach that bucket," not "did our receptionist get phished."

The vendor you never contracted

Identity verification is a supply-chain problem that looks like a clipboard. A yard, a clinic, a law office, or a dealership pays for "ID check" and never sees the cloud region, the retention period, or the list of other tenants on the same platform. When the platform is the incident, your privacy file still has your name on it. PIPEDA and the provincial acts do not care that the processor is in Louisiana. They care that you collected a licence image and sent it somewhere.

If you scan IDs as part of work, write down the processor this week. Ask where images are stored, how long they are kept, whether they are reused to train a model, and what the vendor will send you when (not if) they have a breach. If the answer is a marketing page, that is a finding. Forensic Five will say the same thing about a camera NVR that phones home: the system that holds the evidence is part of the risk.

What we would do this weekend

• If you handed a licence to a rental desk, a retailer, or a financial onboarding flow in the last couple of years, treat a new credit file or a SIM-swap attempt as more likely, not theoretical. Freeze or alert at the bureaus you actually use.
• Watch for "your licence is on file, please confirm" phishing. The leak is real enough that the pretext writes itself.
• If your shop scans IDs, inventory the vendor, the retention, and who can export a batch. Do not wait for a provincial commissioner to ask.
• Do not pay a random site that offers to "check if you are in Nexus." The service went offline. A look-up kiosk is just another harvester.

Bottom line

The scans were not stolen from the registry. They were sitting at a checker most people never named. Forensic Five reviews vendors and backups the same way we review a website: what is copied, who can reach it, and what you would tell a client if it walked. From St. Albert, Alberta. Ask the ID vendor the ugly questions while the story is still in the paper.