They Verified Identities. They Lost Them All.

# They Verified Identities. They Lost Them All. 153 million. That is the number on the wire tonight. IDScan exists to prove documents are real and people are who they claim to be, but they just confirmed a breach of over 153 million driver's licenses. I don't care about the how or the who for the first ten minutes when I see a number like that; I care about the blast radius. If you put 153 million government IDs in one spot, you didn't build a security product, and you built a gold mine for every identity thief from here to Novosibirsk. I can guess what the official statement says. It will be full of talk about working tirelessly with experts and will probably call the attack sophisticated. Why is that word always used? Whenever I hear sophisticated, I wonder if someone just found a password in a public GitHub repo or left a database open to the internet without any password at all. In my experience, sophisticated is corporate code for we're embarrassed and don't want to tell you the truth. Think about how this failure actually happened; IDScan isn't a target because of their bank balance; they are a target because they aggregate data. The attackers likely didn't use some state-sponsored zero-day. They probably hit a weak API or used credentials with too many permissions, like an admin account that hasn't changed its password since 2019 and has access to every cloud bucket. Getting breached happens. It is basically a rite of passage if you run a server. But keeping 153 million licenses in a way that lets an attacker walk out with all of them at once is a choice. If you store that much PII, your first thought shouldn't be about keeping people out. You should ask how to make the data useless once they get in, and that means encryption at rest where the keys aren't on the same server as the data and strict rate limiting. The system should scream and shut down if an account suddenly requests ten thousand licenses a minute. Instead, we have a total loss. I still think about that 2015 OPM breach. That was the gold standard for national identity theft. The real problem here is how permanent this stuff is. You can swap a password or kill a credit card (which is easy enough). You can't just go out and get a new driver's license number or a brand new face to go with it; for 153 million people, this isn't some short term glitch. It's a liability for the rest of their lives. The company will probably say they need all this data for their verification services. They'll claim compliance or accuracy requires them to keep these records on hand. It's a lazy way to argue, and why store every raw image and bit of metadata in one big, open pool? You verify the document, create a signed token (a cryptographic one) that says the ID is valid, and then you purge the images or shove them into an offline vault. If you keep all that data "hot" just for convenience, you're prioritizing your own developer experience over the lives of your customers. Now, let’s talk about the second-order effect, because this is where the real damage happens. IDScan isn't alone here. Banks, casinos and government agencies use them for KYC checks; now their whole trust model is flipped. The tools meant to stop fraud basically handed out the blueprints, and if an attacker has 153 million verified licenses, they can build synthetic identities that you can't detect since the data is real. The banks using IDScan are sitting ducks. Who's to say a "verified" customer applying for a loan tomorrow isn't actually a criminal with a stolen license from this leak? What does this cost you on a Tuesday? If you're the CISO at one of these banks, it costs you your weekend and likely your job once the fake accounts start hitting. IDScan is playing the usual game. They confirm the breach, say they're sorry and offer credit monitoring; that's a band-aid on a gunshot wound. It doesn't stop someone from using your license to open an account. It just tells you it happened after the fact. The real failure here isn't that a hacker got in. The failure is the architecture of the data. I've seen this movie. NotPetya was similar, though that focused on destruction and availability instead of theft. The problem is always the same. Companies don't know where their crown jewels are or who holds the keys. They thought they were secure because they bought a fancy vendor and installed a firewall. They forgot basics like least privilege and segmentation. Are you a junior analyst? Look at your own environment. Find the big buckets. Locate that one database or S3 bucket containing everything the company cares about, and ask yourself if you could empty the whole thing with the credentials for that one account. If the answer is yes, you don't have a security strategy; you have a countdown clock. Huge data dumps are spiking, and just this week, millions of records leaked from government agencies, health providers and identity verification firms. People in this industry love to talk about resilience. You aren't resilient if you keep a mountain of radioactive data that spills everywhere the moment something goes wrong. I bet the official report blames some sophisticated actor or one specific vulnerability, and they'll find a CVE, patch it, and call it a day. That doesn't solve the problem; patching the hole doesn't matter when the room is already full of gasoline. Companies treat PII like an asset they can hoard. It's a liability. Until they realize that, we're just waiting for another hundred million records to leak. Will any of the banks using IDScan admit they're at risk? Or will they pretend their verified pipeline is still clean? I'm betting on silence.