153 million ID leak shows the risk of outsourcing identity verification

A US identity verification company spent more than a year with an active leak of every document it scanned, and no one internally noticed. The case, revealed by Brian Krebs and reported by Techdirt, involves 153 million scans of driver's licenses from the US and Canada now for sale on the dark web, with new records being added all the time.

The number isn't static: according to Krebs, the identity theft service called Nexus added almost 400,000 records in just 24 hours, a sign that freshly stolen data continued to be exfiltrated on a semi-regular basis. In the service's launch post, the criminals were direct:

We have been continuously exfiltrating new data for over a year into our private database. Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.

>

-- Nexus service post, quoted by Brian Krebs

Who the company is and why it matters for architecture

The source of the leak appears to be IDScan.net, based in Louisiana, which has contracts with thousands of cannabis dispensaries as well as names like Hertz, FedEx, and Target. The company also handles age verification for several tech companies and even maintains a page tracking state age-verification laws.

The point that matters to anyone building software: IDScan.net is a verification-as-a-service provider. It's the "third party" that hundreds of applications call via API when they need to confirm that a user is who they say they are, or that they meet a minimum age. Each of those integrations delegated the most sensitive part of the flow (the scanned official document) to an outside black box.

It's exactly this model that the leak calls into question. The company maintained a "Trust Center" explaining "how we protect data, maintain system reliability, and earn the trust of customers and their users," complete with GDPR and CCPA compliance badges, while every record was leaking in real time. Documented compliance and declared transparency didn't stop the pipeline that stayed open for over a year.

What this changes for those building KYC in Brazil

Here's the angle that rarely shows up in foreign coverage: fintechs, marketplaces, payment gateways, and any product under KYC/AML rules in Brazil depend, at some point in the chain, on identity verification and liveness-check vendors. The IDScan.net case is a case study of what happens when that outsourced link is compromised.

Some practical implications for the architecture of anyone integrating this kind of service:

• You don't control the vendor's retention. If the partner keeps document scans (instead of processing and discarding them), the attack surface is theirs, but the leaked data belongs to your user. It's worth contractually requiring a minimal retention policy and checking whether the service offers an ephemeral processing mode.
• Compliance badges are not a guarantee of operational security. GDPR, CCPA, and, in our context, LGPD (Brazil's data protection law) compliance describe obligations; they don't prove the pipeline is sealed. IDScan.net had the certifications and leaked anyway.
• A leak lasting more than a year without detection is an observability failure. The most alarming detail isn't the breach itself, but that no one noticed continuous exfiltration for 12+ months. For those who operate systems, it's a reminder that monitoring access to sensitive data and detecting exfiltration need to be treated as a requirement, not an extra.

Under LGPD, identity document data counts as sensitive personal data in processing practice, and an incident of this scale would trigger a duty to notify the ANPD (Brazil's data protection authority) and the data subjects. A Brazilian product that integrates a compromised vendor can be held jointly responsible for the processing, even if the leak occurred on the partner's infrastructure.

The real damage goes beyond credit fraud

Krebs spoke with Larry Baldwin, a security researcher at Cybera, who detailed why this type of data is especially dangerous. Driver's licenses are routinely used as proof of identity to open new lines of credit, but the risk doesn't stop there:

Just when it seems like we're making some headway in improving authentication controls through drivers license verification systems, this happens and the very thing those improvements are dependent on are compromised.

>

-- Larry Baldwin, Cybera, in an interview with Brian Krebs

Baldwin pointed out that the service dangerously exposes people who can't simply change their appearance to escape AI recognition, including domestic violence survivors and people in witness protection programs. It's the kind of damage that isn't fixed by changing a password.

Community reaction

In the Hacker News thread, much of the discussion focused on the outsourcing model itself. User dan8mx pointed out in the original article something that resonates for anyone designing these systems: identity is an extremely high-value target, and the hackers were charging US$100 per document, signaling a return high enough to justify a difficult attack.

There were also those who argued for taking random third parties out of the equation entirely. In the thread, padjo reported testing the Irish government's digital wallet:

Definitely seems like the way forward if we're intent on doing identity verification. I'd rather the government mediate this than a bunch of random 3rd parties.

>

-- padjo, on Hacker News

It's an interesting counterpoint for the Brazilian scenario, where the digital identity wallet and Gov.br (Brazil's unified government services platform) already centralize part of this identity mediation under the State, instead of spreading it across dozens of private vendors.

What remains open

The FBI's New Orleans field office opened an inquiry to investigate the origin of the images. There's still no official confirmation from IDScan.net about the leak, and the company's "Trust Center" remained online days after the revelation. For those building these systems, the practical lesson doesn't depend on how the investigation turns out: every piece of verification data becomes a record, and every record becomes a target. If your product delegates this step to a third party, the risk is still yours, and it's worth mapping now which vendor keeps what, for how long, and how you'd be notified if it leaked.