From the article:
“it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana.”
Worth noting that 5 US states (e.g. Florida) have stopped issuing standard drivers licenses and effectively force their residents to obtain a “Real ID” which includes additional data – which of course makes more sensitive data available to cybercriminals.
(edit) BTW, would be useful to have a free-world venue for posts just about data breaches. Proposal here.
Can we get eIDs now, please?
Edit: this could be done poorly, so let me clarify that we need government issued smart cards used for cryptographic authentication, which would deprecate photos of KYC documents as a method of auth.
the timestamp on my license scan corresponds to a date in June 2025 when I took a flight to the midwest United States to attend a family funeral
Jesus fuck. I guess that’s something you can’t opt out of? I want to know who took that photo: the airline or TSA.
Edit:
first, I thought the source of the data might have something to do with airports. However, that theory went out the window when it became apparent there were no passports in this data set
…
from reviewing car rental records shared by several people…Yeah, that makes more sense
Curiously, the identity records include not only drivers licenses but also marijuana dispensary cards
Yeah, this is why I refuse to buy from dispensaries that scan my ID card in any way.
If you want to see it with your eyes, that’s fine. I have no problem authenticating with a human. But as soon as you want to put it in front of a camera lens, that’s me walking out the door.
The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit.
Oh wow, this person knows how to do marketing.
Email Brian Krebs a copy of their license, and you’re gonna get some serious traffic.
