ID verification data breach exposes 153M driver's licenses
A major breach of ID verification infrastructure gave hackers a live feed of every ID being scanned for over a year, exposing 153 million driver's licenses. Brian Krebs covered it in detail. The HN thread was a mix of dark humor and genuine alarm, with commenters pointing out that the entire industry built on document verification is now demonstrably compromised.
This matters beyond the obvious privacy angle. A huge chunk of online identity verification, age gating, KYC compliance, and fraud prevention runs through exactly this kind of third-party scanning infrastructure. The breach means that the data companies are collecting to prevent fraud is itself a fraud risk.
One commenter noted, sarcastically, that this is 'a sacrifice we just have to be willing to make as a society if we want to protect kids from the horror of using the internet.' The sarcasm points at a real tension: the regulatory push for ID verification as a safety mechanism is running directly into the reality that ID verification infrastructure is not secure.
So what?
If your product relies on third-party ID verification for compliance or fraud prevention, you need to know which vendor you're using and whether they were affected. More broadly, this is an argument for collecting the minimum verification data necessary and for being very skeptical of any vendor claiming their document scanning is secure.