Millions of driver’s licences were allegedly listed for sale on the dark web. What does it mean for Canada’s push for age assurance?

The Federal Bureau of Investigation (FBI) is probing the alleged sale of millions of identity documents belonging to Canadians and Americans on the dark web, prompting experts to question the security of Ottawa’s proposed social media age ban. On Sept. 1, Brian Krebs, author of the blog Krebs On Security, reported a dark web service called Nexus was claiming to have digital scans of identity documents belonging to more than 170 million people in North America. About 153 million of those documents were reportedly driver’s licences belonging to Canadians and Americans, while identification cards, travel documents and international IDs, and medical cards were also included. Krebs, an investigative cybercrime reporter and former Washington Post journalist, accessed the site after learning his own information was compromised. He found a search of Canadian driver’s licences returned roughly 1.1 million results, with nearly half coming from Ontario. Nexus claimed the licence scans were coming from an active breach at a major identity verification company, whose customers include multiple Fortune 500 companies, Krebs wrote. In an email statement to The Wire Report, the FBI confirmed it is looking into the incident, but declined to comment further due to “the ongoing nature of the investigation.” In another statement, a spokesperson for the Royal Canadian Mountain Police (RCMP) said the agency is “aware” of the alleged incident. “We are monitoring the situation and remain engaged with domestic and international law enforcement and cybersecurity partners as appropriate,” the statement said. The RCMP spokesperson said the force remains “committed” to investigating reported cybercrime, but does not comment on investigations led by other police services, or “confirm, deny, or release information relating to investigations until charges are laid and the matter becomes public record.” Following news of the breach, experts are amplifying preexisting concerns over Bill C-34, the Safe Social Media Act, saying the incident could be a presage of what’s to come under the proposed legislation’s social media ban for children under 16. ‘No system is completely secure’ If the age ban gets Parliament’s green light, it’s not just kids who will be at risk, said Sharon Polsky, president of the Privacy & Access Council of Canada, as every Canadian who wants to use a regulated website will have to verify their age to ensure they are over 16. That means collecting identifying information from millions of Canadians, which Polsky argues could set up the majority of the population to fall victim to a large-scale data breach akin to the Nexus incident. Polsky told The Wire Report all information collection creates some level of risk. “Because no system is completely secure,” she said. “Simple as that.” David Fraser, privacy lawyer at McInnes Cooper, said this incident should raise “significant” red flags for the age ban in C-34, and he wants to see cabinet scrap it from the bill. When it comes to age and identity verification, he said, the severity of the risk depends on the sensitivity of the information collected, and “we need to be very careful” when considering what technology is used, which information is gathered, and how. Fraser said there are a range of harms that come from data breaches, but people are most focused on identity theft and fraud. “The information on your driver’s licence is exactly what a bad guy needs in order to impersonate you,”Fraser told The Wire Report. According to Krebs, several high ranking American officials were featured on the compromised list, including U.S. secretary of war, Pete Hegseth. However, when it comes to data breaches, Fraser’s most worried about the consequences to society’s most vulnerable. “I’m willing to bet there’s probably thousands of women who are fleeing abuse, for whom their home address… legally has to be on a driver’s licence,” he said of the Nexus database. “Having that home address exposed is going to put them at personal risk.” “That’s a fact that we need to take into account for anything that scans or verifies or does anything with identity documents.” It’s not just abuse victims who are at greater risk than the average person, Fraser noted. “If you were to walk up to a cop on the street and ask them for their home address, they’re not going to give it to you,” he said. “And they have a legitimate reason to be concerned about their home addresses becoming public knowledge.” "It’s not just the ordinary person who , ‘Well, I don’t want my date of birth out there,’ or, ‘That puts me at risk of identity theft or fraud.’ It could put people at risk of significant physical harm.” Age assurance an open question in C-34 Bill C-34 does not outline what age assurance should look like in order to enforce the social media ban. Like many aspects of the legislation, compliance with the ban will be enforced by a yet-to-be-established regulator. With so much of the bill left up to regulation, Fraser said it’s hard to tell what age assurance will look like, and whether platforms will use age estimation, age verification, or a mix of both. “It’s impossible to say exactly how it will play out,” he said. “So it could be really horrible, it could be just slightly bad.” The use of biometrics, Fraser said, is becoming more common in age verification, which he said is also the most reliable method. The technology scans a user’s face and compares it with the photo on their ID. “But is that reasonable and appropriate and properly secure or privacy protective? Because it goes much further than a yes or a no, this person is above the age of 16,” he said. “Because if it involves government-issued photo ID, it’s going to have my name on it, it’s going to have my date of birth, it’s going to have my sex or gender, it’s going to have whether I have to wear glasses to drive, other information like that.” As the reliability of age assurance technology increases, so does its level of privacy intrusion, Fraser said. This is where he thinks Canada needs to strike a balance for every sector that uses the technology. Fraser said there needs to be careful thought into whether the information that is being gathered is necessary and appropriate for the context. If it is deemed appropriate, the privacy risks also need to be identified and adequately mitigated to make the risk as low as possible. “There’s a whole lot of different moving parts and a lot of variables that, I think, a number of people have kind of oversimplified,” he said. Other methods, he said, are less privacy intrusive, although not without their risks. Rather than deploying biometrics, facial age estimation can provide a general idea of a user’s age. That practice, however, is less reliable and easier to circumvent. Privacy risks and age verification No matter what method and technology is used, Fraser is concerned about what happens to the information afterward. Although Bill C-34 calls for the deletion of data after the age check is complete, “the reality is that some companies don’t do that, don’t follow the rules,” Fraser said. Even if companies are deleting the information immediately, Matt Hatfield, executive director of advocacy group OpenMedia, said there are still big privacy risks. Given the Nexus site reportedly claimed to be collecting data from an active breach, Hatfield said it seems the hackers were intercepting data at the point of collection. If that were the case, it means bad actors would have access to the data regardless of whether the breached company was retaining it or not. Hatfield said this raises questions about whether C-34 has adequate safeguards to protect against a breach. “I think the answer is no,” he said. While Hatfield wants to see the age ban scrapped, citing both the privacy risks and freedom of expression, he said if the government is going to implement age assurance, the privacy commissioner should be tasked with approving and denying any technologies. When asked about whether the breach raises concerns for mandated age assurance in Canada, the Office of the Privacy Commissioner (OPC) said in an email statement that it “is aware of this matter and is reaching out to the company to obtain more information and determine next steps.” Senator Julie Miville-Dechêne has long faced criticism for Bill S-209, which she has been trying to push through Parliament for five years. The Protecting Young Persons from Exposure to Pornography Act is now through first reading in the House of Commons, but through three iterations it has faced backlash for privacy risks associated with its mandate for age assurance use in pornography websites. When asked if she thinks the Nexus incident will serve as a hurdle for her bill, Miville-Dechêne referenced OPC age assurance guidelines published in May, which said privacy risks are “not inherent to the use of age assurance.” In her email statement, she said “I also like to remind that Bill S-209 doesn’t choose any particular age verification method, it only states strong principles to be respected around, most notably, privacy.” “I still think those principles stand and give enough flexibility to the government to decide on regulations that will protect privacy of users, if Bill S-209 becomes law,” she wrote. Both Polsky and Fraser noted age assurance is a growing market, which will continue to expand as more countries implement age bans for underage users. Polsky is concerned with the prospect of a growing number of platforms collecting information from Canadians and promising privacy protection but not delivering. Fraser said those companies are going to become “extremely attractive” targets for bad actors. “The recent reporting about this recent incident tells you there’s a value to that information,” he said. “That bad guys are willing to sell it, and other bad guys are willing to buy it.” No way to put ‘genie back in the lamp,’ says Hatfield Meanwhile, Hatfield suggests the growing appetite and widespread use of artificial intelligence (AI) could make large-scale breaches more common. “There’s both reason to worry about the harms that could occur from requiring information collection today as it is, but also . . . there’s reason to think we’re going to see many more cybersecurity breaches in the future than even we’re used to seeing to date,” he said. “Of course, we have AI models becoming very broadly distributed. They’re very good at sniffing out these kinds of vulnerabilities.” Earlier this year, Anthropic PBC discovered its new AI model, Claude Mythos, is extremely proficient at identifying vulnerabilities in “every major operating system and every major web browser,” according to a blog post from the company. Some of those security systems have been operating for ten or twenty years, unaware of the difficult-to-detect bugs. Following the discovery, Anthropic held Mythos off the market and released a version of it to select companies “to help secure the world’s most critical software.” This is the exact scenario that worries Hatfield – bad actors using advanced AI models to facilitate information breaches. “We’re creating these new vulnerabilities and new pools of sensitive data, and at the same time, we can expect those pools are gonna be under much greater attack than they have been in the past,” he said. Although the number of Canadian IDs breached on the Nexus website is much smaller than the number of American IDs, Hatfield also argued mandating age assurance could set up the majority of Canadians for a “catastrophic” breach. He pointed out that most of the information on a driver’s licence is extremely difficult and impossible to change. Once it’s out there, “there’s really no way of putting the genie back in the lamp,” he said. Polsky suggested that, since the data base contained information on American politicians, it’s likely Canadian politicians were breached as well. If so, she hopes that’s motivation enough to send the Liberals back to the C-34 drawing board. “That might be the wake up call that they need to realize that what they’re promoting puts everybody at risk,” she said. “Including themselves, and their children, and their family members, and the people that they care about.” mcollins@thewirereport.ca

Millions of driver’s licences were allegedly listed for sale on the dark web. What does it mean for Canada’s push for age assurance?

Regulatory |
By Maria Collins
|September 15, 2026

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Millions of driver’s licences were allegedly listed for sale on the dark web. What does it mean for Canada’s push for age assurance?

Regulatory | By Maria Collins |September 15, 2026

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Liberals propose amendments to Radiocommunication Act in effort to reduce red tape

OPINION: Cybersecurity legislation has passed. Now the real work begins

CRTC dismisses challenge raising concerns of government interference

Related Stories

CMPA survey finds continuing public support for Online Streaming Act

CRTC releases standards for wireless connectivity reporting

Film and video distribution industry revenues on the rise: StatsCan

Eastlink data breach affects 75,000 customers

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Regulatory |
By Maria Collins
|September 15, 2026