Brian Krebs counted 473,673 Ontario driver's licence scans in a dark-web stall the FBI says it is looking into
The bureau has confirmed only that it is looking into the incident, and the Canadian and Ontario counts are Krebs's own search of the seller's listing rather than any official total. No page from CBC, the Globe and Mail, CTV, Global News or Postmedia carrying either was located between 2 and 5 September.
What funded newsrooms reported
No page from CBC News, which carries a parliamentary appropriation, or from the Globe and Mail, CTV News, Global News or the Postmedia chain was located between 2 and 5 September carrying the FBI's confirmation or the Canadian slice of the listing.
The story was not obscure. The Reuters wire moved the FBI line on 2 September and it was picked up widely outside Canada, including by TIME on 3 September. TechCrunch ran Zack Whittaker's piece on 2 September, and by 4 September BleepingComputer was reporting that lawsuits had been filed in Louisiana. The Canadian element — that a Canada-only search of the listing returned licence records, most of them Ontario — travelled with it.
What was already public
- 1.The FBI said it is "looking into the incident" and declined to provide further detail because of the ongoing nature of the investigation. It confirmed no count, did not name a victim company and said nothing about Canadian records.FBI Probes Report of Breach Exposing 153 Million Driver's License Scans (TIME, 3 September 2026)
- 2.Researchers identified the likely source of the images as IDScan.net, a New Orleans identity-verification provider, but this is not confirmed. The company's chief operating officer told Krebs it was investigating; its chief executive did not respond to TechCrunch.It sure looks like hackers breached a major ID card verification service (TechCrunch, 2 September 2026)
- 3.By 4 September, lawsuits had been filed against IDScan in Louisiana and two law firms had opened class-action investigations. IDScan had published no statement on the allegations and did not respond to requests for comment.IDScan sued over alleged data breach affecting 153 million drivers (BleepingComputer, 4 September 2026)
- 4.The operators of the Nexus listing claim the images come from a major identity-verification company undergoing an active breach. Krebs traced the material to scans captured at car rental counters and cannabis dispensaries.FBI Probes Service Selling 153M Driver's Licenses (Krebs on Security, 1 September 2026)
What the independents said
The reporting on this story has been carried almost entirely by independent and specialist outlets. Brian Krebs, who publishes Krebs on Security on his own, broke it on 1 September, counted the listing himself and gave the Canadian and Ontario numbers that no government has produced. Zack Whittaker at TechCrunch established on 2 September that the source is identified but not confirmed, and that the company named by researchers would not answer. Bill Toulas at BleepingComputer followed the litigation on 4 September.
One Canadian outlet did cover it. The Canadian Cyber Security Journal ran a piece on 2 September aimed at Canadian businesses and individuals, and it was careful in a way the numbers above are not: it told readers that the exact number of Canadian records inside the archive remains undisclosed, and offered no provincial breakdown.
- Brian Krebs, Krebs on Security — FBI Probes Service Selling 153M Driver's Licenses
- Zack Whittaker, TechCrunch — It sure looks like hackers breached a major ID card verification service
- Bill Toulas, BleepingComputer — IDScan sued over alleged data breach affecting 153 million drivers
- Canadian Cyber Security Journal — Dark Web Service Sells 153 Million Driver's Licenses — Canadian Records Among the Leak
The gap
The funded Canadian desks did not include either half of this: not the FBI's confirmation that it is looking into a stall advertising North American licence scans, and not the Canada-only count that put Ontario at 473,673 records.
The independents did not include a Canadian check on their own Canadian numbers — nobody put the Ontario figure to the Office of the Privacy Commissioner of Canada, ServiceOntario or the Ontario Ministry of Transportation, and the one Canadian outlet that ran the story said plainly that the number of Canadian records remains undisclosed, which is not the same thing as 473,673.
The caveat — against our own framing
Nexus is an advertisement on a criminal forum, and sellers on criminal forums inflate. The FBI has adopted none of these counts, has named no victim company in public, and IDScan.net has said nothing publicly at all. No provincial ministry or privacy regulator has confirmed that a single Ontario licence image is in the set. A Canadian news desk that declined to run a forum listing's self-reported provincial tally until someone in Canada could verify it made a defensible call, and it is possible that what is counted here as an absence was caution rather than neglect. The counter-argument is only that the FBI's own confirmation of an inquiry needed no such verification, and that did not run either.
Sources
- 1
- 2
- 3
- 4
- 5
One story per issue. Every claim sourced.
No tracking pixels, no partner mail, one unsubscribe link in every issue.
By subscribing you agree to receive Second Reading by email. We store your address and the record of your consent, nothing else. Privacy.