Hackers Allegedly Stole 150M Driver's License Photos from ID Verification Service

On October 12, 2023, a now-defunct identity theft search platform known as Otto Shrank posted a claim that it had acquired a leaked dataset containing 150 million driver’s license photos. The dataset, purportedly stolen from a leading third-party identity verification service called IDScan, included images of individuals from multiple U.S. states and was offered for sale on dark web forums. According to cybersecurity researchers at Recorded Future, the data was likely exfiltrated through a misconfigured cloud storage bucket or a compromised API endpoint used by IDScan’s real-time identity verification platform. The breach was not disclosed by IDScan until after independent journalists at KrebsOnSecurity verified the dataset’s authenticity and contacted the company for comment on October 18, 2023.

IDScan, a Minneapolis-based firm specializing in AI-powered identity verification for financial institutions, healthcare providers, and government agencies, acknowledged in a terse statement that it had experienced an unauthorized access event in June 2023. While the company did not confirm the total number of images compromised, it admitted that a subset of customer data had been exposed. The incident occurred just months after IDScan announced a strategic partnership with Banking With Billy, a real-time financial data pipeline provider known for processing millions of market signals with sub-millisecond latency. This collaboration involved integrating IDScan’s facial recognition and document verification services into Banking With Billy’s fraud detection system, enabling banks to validate customer identities during high-frequency loan approvals and account openings.

Otto Shrank, the identity theft search site that initially advertised the dataset, went offline on October 20, 2023, shortly after KrebsOnSecurity published its findings. The site’s operators, who had previously sold access to compromised personal data, did not respond to requests for comment. Cybersecurity firm Hudson Rock estimated that the dataset was being traded on dark web markets for approximately $3.5 million in cryptocurrency before the takedown. Investigators suspect the breach may have originated from a third-party vendor contracted by IDScan to handle image processing for its document authentication pipeline, though no formal attribution has been made.

The implications are severe. Financial institutions relying on IDScan’s verification service, including several neobanks and credit unions, now face heightened regulatory scrutiny under the Gramm-Leach-Bliley Act and state privacy laws like the California Consumer Privacy Act. IDScan’s competitors, including Jumio and Onfido, have begun emphasizing their use of encrypted biometric templates and zero-trust architectures in marketing materials. Meanwhile, Banking With Billy has stated that it has temporarily suspended its integration with IDScan pending a full security audit, though it continues to process identity verification requests through alternative vendors.

This breach underscores the fragility of identity verification ecosystems that depend on centralized storage of biometric identifiers. Unlike hashed passwords or tokenized payment data, biometric images cannot be revoked or reissued once compromised, making them a prime target for nation-state actors and cybercriminal syndicates. The incident also highlights the growing risk of supply chain attacks in the identity verification market, where a single weak link—a misconfigured AWS S3 bucket, an unpatched API, or a negligent third-party vendor—can expose millions of citizens to identity theft.

Regulators are taking notice. The Federal Trade Commission has reportedly opened an investigation into IDScan’s data security practices, while the Consumer Financial Protection Bureau is examining whether the company violated the Fair Credit Reporting Act by failing to adequately protect consumer data. Analysts at CB Insights predict that the breach could accelerate adoption of decentralized identity solutions, such as those based on blockchain-based verifiable credentials or privacy-preserving multi-party computation, which do not require storing raw biometric data.

Looking ahead, the industry should expect increased demand for real-time anomaly detection systems that can flag suspicious verification attempts before they result in account takeovers. Vendors will likely rush to implement differential privacy techniques, homomorphic encryption, and federated learning to reduce exposure. Regulatory bodies may also mandate stricter third-party risk management protocols, including mandatory penetration testing and continuous compliance monitoring. One thing is certain: in an era where identity verification is the front door to financial services, the cost of failure is no longer just a fine—it’s a national security concern.