ID card verification leak

TechCrunch reports It sure looks like hackers breached a major ID card verification service:

If you have handed over your driver’s license, passport, or other form of identity document to verify your information in the real world, like at a bar, a weed store, or when booking a car rental, there’s a good chance it’s now been stolen in a suspected massive data breach.

This breach of 153M+ record includes US and Canadian IDs, as well as a trove of other international documents. A company whose business was to verify ID didn’t protect said data. The story was originally reported by Brian Krebs, who found his own ID for sale on an illegal service advertised on a known Russian forums called Nexus. The service has since vanished.

The people behind Nexus claim the license images are coming from an active breach at “a major identity verification company” whose customers include multiple Fortune 500 companies.

Krebs speculates, based on the time stamps, that his ID was scanned when he rented a car. Said ID verification company has also been contracted by over 1,000 marijuana dispensaries in 19 US states.

As various Governments want to mandate ID verification for internet services (they call it age assurance), this exhibit clearly the danger of such a practice. The cynical me really hope that a lot of politicians are in this trove, which would probably make action more concrete ; it’s already confirmed the US Defence Secretary is in there.

The question is whether the retention policy of the customer was followed (some of the one interview claim the policy is to not retain the documents past verification)? If yes, then why do they require such retention? Can impacted people sue the company that contracted the ID verification service. There need to be heavy penalties and and other safe guards needs to be enacted (including a ban on the practice).

More reasons to be very reluctant to have your ID taken out of your hands.

Nobody could have predicted this. #sarcasm

Previously: Discord and ID verification, a tale, Age verification vs privacy