Third-party ID vendor diligence

Identity vendors
Licence scans
Partner oversight
Client-side control

004 / 2026

You hand a driver’s licence to a rental desk, a hotel, a venue, or a vendor “just to verify.” The moment that image lands in a third-party identity stack, the control question is no longer whether the plastic looked real. It is who stores the copy, for how long, under whose standard, and what happens when that vendor’s cloud is the weak link.

That is control before coverage.

What Canadian authorities and reporting actually say

On 21 September 2026, the Privacy Commissioner of Canada, Philippe Dufresne, opened an investigation into a data breach at IDScan.net after reports that an unauthorized third party gained access to company systems and stole personal information, including digital scans of driver’s licences and other identification. The Office of the Privacy Commissioner of Canada (OPC) said the investigation will examine the safeguards IDScan.net had in place and the adequacy of notifications to affected individuals under the Personal Information Protection and Electronic Documents Act (PIPEDA). The OPC noted it has been engaging with the company and is not providing further details while the investigation is active.

That Canadian primary sits on top of a September reporting arc that should be kept carefully separated.

Krebs on Security reported on 1 September 2026 that a dark-web service marketed as “Nexus” advertised digital scans of more than 153 million U.S. and Canadian driver’s licences, plus other identity documents. Krebs’s sampling found roughly 1.1 million Canadian licence results, with a heavy Ontario concentration. He reported that the New Orleans FBI field office opened an inquiry into Louisiana-based identity-verification firm IDScan.net as a likely source, and that Nexus went offline after publication. Those marketplace totals are claims and reporting from that investigation — not a government-confirmed Canadian victim count.

IDScan.net later stated that on or around 1 September it received information that certain data may have been accessed without authorization, and that an unauthorized third party may have accessed or copied certain customer information from its cloud accounts — including full names and driver’s licence or other government-issued identification numbers. The company said it is notifying potentially impacted individuals and offering credit monitoring and identity-protection services, and that it is cooperating with law enforcement.

Separately, the RCMP told Global News it was aware of reports regarding the alleged exposure of driver’s licence data, was monitoring with partners, and typically does not confirm or deny investigation details until charges are laid. That is monitoring language — not a confirmed national victim total.

Keep those layers distinct in any reuse: Krebs reporting, company notice, RCMP monitoring, and the OPC’s PIPEDA investigation. Do not collapse them into “153 million Canadians were confirmed breached.”

Why this matters for Alberta principals and Canadian operators

Identity-verification vendors sit in the middle of ordinary life for executives, family offices, and mid-market firms: travel, hospitality, age checks, onboarding, and vendor KYC. A licence image is not “just a photo.” It is a portable identity token used to open credit, spoof in-person checks, and support social engineering that starts with a real name and a real face.

For Alberta and broader Canadian clients, the transferable lesson is not provincial politics about what appears on a licence card. The lesson is vendor diligence: which third parties scan and retain government ID, what retention looks like, what happens on breach, and who owns escalation when the vendor — not your corporate stack — holds the copy.

Adjacent protective-intelligence risk is real without fear copy. Licence images and identity numbers can fuel impersonation, account takeover, and targeting of principals who travel or keep soft residential footprints. The proportionate response is exposure awareness and process ownership — not a claim that more household cameras fix a cloud retention failure.

The control question: who holds the scan?

Before the next vendor asks for a licence image, answer these in writing.

Who needs the scan at all, versus a yes/no age or identity assertion that does not require retaining the image?

Where is the image stored — vendor cloud, customer account, both? How long is it retained, and who can delete it?

What breach notification path exists for Canadian individuals and for the Canadian organizations that used the vendor?

Who on the client side owns vendor diligence for ID-verification tools the same way finance owns payment-destination changes?

If those answers live only with the vendor’s marketing page, you are running on hope. Hope is not a control.

Forged-CS’s lane here is advisory: map digital exposure around principals and families, diligence the vendors that hold identity artifacts, and set the oversight standard from the client’s side of the table. Where regulated investigative field work is required under Alberta or other applicable law, that work belongs with vetted licensed partners. Oversight stays with the client. We do not run a 24/7 SOC, a guard roster, or an identity-monitoring product factory.

Client-side diligence that actually moves risk

Start with an inventory. List every routine where your principals, executives, or staff hand government ID to a third party that may scan and retain it — travel rental, hotels, venues, onboarding vendors, background-check processors, and any “verify to enter” app. You cannot oversee what you have not mapped.

Ask vendors hard retention questions before you need a breach notice. Prefer flows that verify without storing a durable image when the business purpose does not require it. Where retention is unavoidable, require written retention limits, access controls, breach notification timelines that meet Canadian expectations, and a named contact for incident response — not a generic support inbox.

Treat post-incident hygiene as a control, not a sentiment. If a vendor you used is in the news, preserve the vendor notice, monitor financial and government accounts for fraud, harden MFA on personal accounts, and treat unexpected “verify your ID again” outreach as high-risk social engineering. Dual-channel verification for identity-recovery requests matters as much here as it does for payment changes.

Separate corporate from household exposure. Executives who use the same personal email, phone, and travel patterns for family life as for work create a single failure surface when a licence image leaks. Map that surface deliberately. Reduce unnecessary public metadata that makes a stolen ID easier to operationalize against a named principal.

After a near-miss or a vendor notice, preserve evidence and timelines. Counsel may need the sequence. If the matter escalates into formal investigation, licensed partners execute regulated work; the client still owns the standard for what “done” means.

What this Brief is not

This is not a claim that every Alberta licence was stolen. It is not a government victim total. It is not a pitch that Forged-CS sells MDR, dark-web marketplace takedowns, or credit-monitoring products. It is decision-ready diligence for organizations and principals who want identity-vendor risk under client-side control — with licensed partners where the law requires field work, and with oversight kept where it belongs.

Control before coverage

If the next identity check starts with “just scan it and we’ll keep a copy,” you are already negotiating from behind. Map who holds the image. Set the retention and notification standard before the next third-party stack becomes someone else’s database.

Then decide what tools or partners you actually need.

Forged-CS is the client-side control layer — risk architecture and partner oversight, not more coverage.

— Hassan Sukhera | Forged-CS | forged-cs.com

FAQs

Why does a third-party ID scan matter if my corporate network is fine?

Because the licence image often never touches your network. It lands in a vendor cloud used for travel, hospitality, or age checks. Corporate controls do not automatically cover that surface.

Did the Privacy Commissioner confirm how many Canadians were affected?

No. The OPC opened a PIPEDA investigation into safeguards and notifications. Marketplace totals reported by journalists are not the same as a government-confirmed Canadian victim count.

What should an Alberta principal do first after a vendor ID notice?

Preserve the notice, monitor accounts, harden MFA, treat follow-on “verify your ID” outreach as high-risk, and inventory where else government ID is routinely scanned and retained.

Does Forged-CS investigate these breaches?

Forged-CS provides advisory, risk architecture, and oversight. Regulated investigative field work, where required, is scoped through vetted licensed partners under applicable law.