Let’s talk about the 153 million driver’s licences that got taken out of a company whose only job was to check ID.
There’s this detail I can’t get out of my head. Brian Krebs, the security reporter, found his own licence in the leaked pile. Not a photocopy someone fished out of him in a scam. His actual Virginia licence — front and back, plus the infrared and ultraviolet scans — with a timestamp on the filename from a day in June 2025 when he flew to the midwest for a family funeral. Then he searched for his mother’s. Hers was in there too, timestamped a few seconds away from his, because the two of them had handed their licences across the same counter, at the same rental desk, at the same moment.
That’s the whole story in two timestamps. You hand over your ID to prove who you are. You assume it gets checked and handed back. It doesn’t get handed back. It gets copied, stored, filed, and added to a pile. And this month, the pile went up for sale.
Here’s what actually happened. On or around the first of September, IDScan.net — a Louisiana company that runs ID checks for car rental firms, retailers, dispensaries — received information that data on its cloud platform had been accessed without authorisation. It posted a notice on the fourth, said it was working with outside specialists, notified people “in an abundance of caution,” and offered them free credit monitoring. That’s the standard language.
But the breach was public before the company confirmed it. A service calling itself Nexus appeared on a Russian cybercrime forum, selling scans of more than a hundred and fifty three million drivers licences out of the US and Canada. Ten million ID cards. Three million travel documents. Five hundred and seventy nine thousand medical cards. The seller was handing out free samples to prove it was real, and the free sample was Krebs’s licence. The FBI’s New Orleans field office opened an investigation. Within a day the number of licences on offer grew by nearly four hundred thousand — the service was still pulling fresh data while everyone argued about who was to blame. Then it vanished. Nine class actions were filed in three days.
Now, everyone is going to tell you this is a cybersecurity story. Harden the vendor, rotate the keys, buy the detection tool.
It isn’t. It’s an architecture story. And that’s the part people keep walking past.
Think about what a KYC check actually is, structurally. To answer one question — is this person who they say they are — the verification company takes your government document, matches it to your face, records a liveness video, logs your address, and then keeps all of it. It has to keep it, to prove it did the check. That’s the audit trail. The file isn’t a side effect of the business. The file is the business. Which means the thing built to guard the door had to build a vault behind the door — and the vault is where the door’s own value sits.
So when the vault gets opened, what leaks isn’t junk. It’s not a list of email addresses. It’s every ingredient of a complete identity, already assembled, already checked, already liveness-verified. A stolen password has to be used carefully. A stolen identity that has already passed the machine is a working key. You don’t forge anything. You just show up as someone who was already let in.
And the timing is ugly, because the check is under attack from the other side too.
Entrust’s 2026 figures put deepfake fraud at roughly six and a half percent of global fraud attempts, up from a tenth of a percent in 2023 — a sixty five fold rise in three years. Injection attacks, where synthetic video is fed straight into the verification pipe before it ever reaches a camera, are up about forty percent year on year, with four hundred and ten million dollars of losses in a single half. Shufti’s September study found that among linked fraudulent attempts, around sixty six percent traced back to the same forged documents being recycled — one cluster of seventy identities sitting across thirteen devices. Because a document check has no memory. It tests an artefact against a template, not against everything that came before it. A ring clears onboarding one request at a time, at each institution that can only see its own single moment.
So we have the same failure from both ends. The copy that gets kept is the target. The check that decides is blind to patterns. And the bank, the airline, the rental desk — none of them knows which of their vendors’ vendors is holding the pile.
What people are missing is that this isn’t a vendor-selection problem you can shop your way out of. Every KYC provider concentrates identity data by design, because centralised verification requires centralised storage, and centralised storage creates one fat target. Switching to a company that does the same thing just relocates the vault. When seven of the biggest players in the industry — asked, that same week, about their own controls — all decline to comment, you aren’t choosing between a safe room and an unsafe one. You’re choosing which room to stand in when the wall comes down.
There’s a better question hiding under all of this, and Krebs’s own readers got to it before the industry did. Why does an age-verification company need to keep a copy of your licence at all?
It doesn’t. It needs one bit. Over eighteen, or not over eighteen. This person, or not this person. The full document, the face, the video, the address — none of that is required to answer the question. It’s required to keep a receipt. And the receipt is what got stolen.
That’s the operator lesson, and it’s blunt. Stop storing what you only needed to check. Verify against a proof instead of a copy. Let the wallet hold the credential, let the check return a signed yes or no, and let the vendor keep nothing that would hurt you if it walked out the door. If you’re the one buying verification, ask three questions before you sign — what do you retain, for how long, on whose infrastructure, and can you prove it. Then ask who sits underneath your vendor. If nobody can answer that, you’re not buying security. You’re buying exposure with a compliance certificate stapled to it.
And the principle underneath all of it, the one that has to survive: you should be able to prove something about yourself without handing over the whole of yourself to be kept on someone else’s drive.
The record is yours. The verifier borrowed it. Most of them never gave it back. And this month, every copy that was kept became a reason someone’s face is for sale.
You don’t fix that with better locks on the same vault. You fix it by keeping less.
You’ve got this.