xxx
A dark web marketplace is selling 153,000,000 American and Canadian driver’s licenses, reportedly siphoned from idscan.net. This platform specializes in in-person identity (ID) verification and serves businesses such as Hertz, FedEx, Target, marijuana dispensaries, and many more.
From: 153M driver’s licenses for sale after alleged leak from IDScan | Cybernews.
xxx
Liminal
The breach illustrates why identity documents are a higher-value and more permanent target than credentials like passwords, and how age-verification mandates are expanding the pool of exposed data.
A driver’s license is far more useful to an identity thief than a password, because a password can be reset while a face, date of birth, address, and license number cannot easily be replaced, especially when paired with high-resolution images of a government ID. The presence of front-and-back images plus infrared and ultraviolet scans means the exposed records include the security features used to validate authenticity, which raises the risk that the data could be used to pass identity checks or produce convincing forgeries.
Malwarebytes ties the incident directly to the growth of age verification, noting that requiring users to upload an ID or selfie to a third-party provider turns a simple website visit into a decision to share an enduring identity document with a company the user may never have heard of. This connects the breach to the wave of age-assurance mandates advancing across U.S. states, the UK, the EU, and Australia, each of which expands the number of organizations, contractors, and cloud platforms holding copies of government IDs.
The incident fits a broader pattern of identity data concentrating in verification vendors that become single points of failure. Facial images and ID copies can be reused to make scams more convincing, pass weak checks, or assemble victim profiles by combining records from separate breaches. The episode strengthens the case for privacy-preserving age and identity checks, such as zero-knowledge or on-device verification, that confirm an attribute without transmitting or storing the underlying document, an approach that vendors and regulators have increasingly promoted.