The editorial argues the leaked images bear tell-tale artifacts of consumer onboarding flows — phone-camera EXIF, indoor glare, KYC SDK checkmark overlays — meaning the source is third-party identity verification vendors rather than government DMVs. The seller's claim of daily fresh uploads suggests an ongoing siphon inside the vendor pipeline rather than a one-shot dump.
Krebs's reporting frames the catalog as an actively-updated underground service with fresh daily submissions, consistent with a persistent exfiltration pipe from KYC providers rather than a stolen government database. His investigation is what triggered the FBI probe.
The editorial argues that a driver's license scan plus selfie is an unrotatable credential — you cannot ask 153 million people to grow a new face. The industry spent five years selling regulators on 'upload a photo of your ID' as an in-person substitute, and this breach exposes every downstream system that trusts an IDV pass as proof of humanity.
By surfacing the Krebs report to the top of Hacker News with 98 points, the submitter framed the story as a major federal-scale incident worthy of broad developer attention. The upvote velocity signals community consensus that an FBI probe covering half the US adult driving population is a serious escalation.
Brian Krebs is reporting that the FBI has opened an investigation into an underground service peddling scans of more than 153 million US driver's licenses — front, back, and in many cases the accompanying selfie used to prove liveness. The catalog reportedly lets buyers query by state, name, or DOB and download a matching ID within seconds, priced in the low tens of dollars per record. For context, the US has roughly 260M licensed drivers, so this haul covers something like half the adult driving population.
The data does not appear to have come from state DMVs. The samples circulating so far carry the tell-tale artifacts of consumer onboarding flows: phone-camera EXIF, glare from indoor lighting, the little green checkmark overlays that some KYC SDKs burn into the image before upload. In other words, these are the photos your users took when they signed up for a neobank, a crypto exchange, a rideshare app, a sports-betting site, or an age-gated marketplace — then handed to a third-party identity verification (IDV) vendor who was supposed to check them and, ideally, throw them away.
The uncomfortable implication is that somewhere in the KYC vendor supply chain — or across several vendors — an actor has been quietly siphoning submissions for years and has now decided to monetize the archive. Krebs notes the seller claims fresh uploads are added daily, which is consistent with an ongoing pipe rather than a one-shot dump.
The first thing to internalize is that a driver's license scan plus a selfie is not a credential you can rotate. You cannot email 153 million people and ask them to grow a new face. The industry spent the last five years convincing regulators that "upload a photo of your ID" was a reasonable substitute for in-person verification; this breach is the bill coming due. Every downstream system that trusts an IDV pass as proof of humanity — account recovery, high-limit transfers, tax filing, unemployment claims, medical portals — is now operating against a synthetic-identity toolkit that fits in a zip file.
Second, the blast radius is architectural, not incidental. Most fintechs and marketplaces do not run their own OCR and liveness stacks; they wire up Jumio, Onfido (now Entrust), Persona, Socure, Veriff, Stripe Identity, Plaid IDV, or one of a dozen smaller shops, and the raw images sit in that vendor's S3 buckets under a shared-responsibility model that customers rarely audit. A single compromised vendor — or a single rogue employee at one — leaks the union of every customer's onboarding funnel. We've seen the pattern before with Okta's support-case attachments and with the MOVEit cascade; the KYC layer has the same shape and worse consequences.
Third, the community reaction on Hacker News is worth reading in full. The top comments cluster around two takes. One camp argues the real failure is regulatory: SOC 2 Type II and PCI-adjacent audits treat ID images as ordinary PII when they behave more like biometric templates, and there is no equivalent of tokenization for a face. The other camp is angrier and more practical — several commenters point out that they explicitly asked vendors to delete images post-verification and were told, verbatim, that retention was required "for compliance," a claim that in most US jurisdictions is either false or badly overstated. The retention was never about compliance; it was about training data, fraud-model feedback loops, and the vendor's own convenience.
Fourth, this reframes some recent product decisions. Apple's push for mobile driver's licenses in Wallet and the parallel work on W3C Verifiable Credentials and EU EUDI wallets suddenly look less like solutions in search of a problem. A verifier that receives a cryptographic attestation of "over 21, resident of California, name matches" — with no image, no DOB, no address — cannot leak what it never held. The question is whether the fintech ecosystem will actually adopt selective-disclosure primitives, or continue asking users to upload a JPEG because the SDK is easier to integrate.
If you operate any product that runs KYC, the honest audit is short and unpleasant. First, find out what your IDV vendor actually retains. Not what the sales deck says — what the bucket contains. Ask for a written retention schedule, ask for the deletion API, and then confirm via a test account that a delete request actually removes the image, the selfie, the video liveness clip, and the extracted OCR fields. In our experience roughly half the time one of those four survives.
Second, decouple the verification result from the verification artifact. The pattern you want is: vendor verifies, vendor returns a signed attestation with the specific attributes you need (age band, name match, document authenticity score), vendor deletes the raw media within N days, and you store only the attestation. If your compliance team insists on keeping the image "in case of audit," push back with the actual regulation text — FinCEN's CIP rule requires you to record the *information* used to verify identity, not the underlying photograph, and state-level laws (BIPA in Illinois, the Texas CUBI, Washington's HB 1493) actively penalize you for hoarding biometrics.
Third, assume the synthetic-identity attack surface just widened materially. Any flow where an uploaded ID image is sufficient to open an account, reset a password, or unlock a limit needs a second factor that a leaked JPEG cannot satisfy — a live video challenge with a randomized prompt, a knowledge-based question tied to real transaction history, a mailed-code loop, or a bank-linked account verification. The cost of adding friction here is small compared to the cost of being the exchange that let a $2M withdrawal go through against a purchased license.
The FBI investigation will grind for months and probably surface at least one vendor name. That will be the interesting moment: not the indictment, but whether the industry treats it as one bad actor or as evidence that the entire "upload your license" paradigm was a mistake we papered over with SOC 2 badges. The right move — mobile driver's licenses, selective-disclosure credentials, zero-image verification — has been technically possible for years; this breach is the forcing function that finally makes the integration work worth doing. Until then, treat every third-party IDV bucket in your architecture as a liability line item, not an asset.
The thing that really gets me about this one is that surely you can easily just delete the data after you've verified someone? But instead they decided to keep 153,347,439 of them.
So an online identity verification service had millions of IDs exfiltrated, many of which were linked to marijuana dispensaries? Oh man, my ID is definitely out there, shit.
It was probably Hertz that was the source of the breaches.
Bankrupt this company to serve as a warning to others that hang on to way too much data.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
One of the more absurd things these ID verification services do is ask for a front and back scan of your licence and then use an app that has you tilt your head around in camera.They obviously do not have actual access to the original photos, so a sophisticated attacker can simply forge the whole th