FBI Probes Service Selling 153M+ Drivers Licenses • Hacker News Board

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#31

Post by akshatjiwan » Wed, Sep 02, 2026, 4:51 AM UTC

analog31 wrote: post #21

Nition wrote: post #12

The thing that really gets me about this one is that surely you can easily just delete the data after you've verified someone? But instead they decided to keep 153,347,439 of them.

I believe we need to criminalize possession of the data, with statutory damages per violation.

Some laws for protection do exist — eg requirement that sensitive data needs to be kept on systems that have been pen tested. But those laws are hardly ever followed and authorities have no real way to check if the 'protected' status of digital storage is actually maintained. What's worse is there are actually voices inside the government that are calling for an end on encryption stating that it encourages criminal activity.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#32

Post by Aurornis » Wed, Sep 02, 2026, 4:52 AM UTC

trollbridge wrote: post #24

One of the more absurd things these ID verification services do is ask for a front and back scan of your licence and then use an app that has you tilt your head around in camera. They obviously do not have actual access to the original photos, so a sophisticated attacker can simply forge the whole thing, but the rest of us have to update very detailed facial information + government ID documents that we all know are…

The ID scans in the article weren't submitted by people from their phones. They include IR and UV scans, too. The database might contain multiple sources but at least the big one appears to have a lot of IDs from physical locations where you hand your ID over the counter to someone to scan.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#33

Post by Aurornis » Wed, Sep 02, 2026, 4:55 AM UTC

Nition wrote: post #12

The thing that really gets me about this one is that surely you can easily just delete the data after you've verified someone? But instead they decided to keep 153,347,439 of them.

The last time I had to read a law about ID verification it required keeping that data for a number of days. They wanted you to have it available in case something happened and the police opened an investigation.

Combine that with a service that is compromised unknowingly for a long period of time and the attackers can siphon out a lot of IDs. Even a service which didn't retain IDs could leak a lot of data if the attackers tapped the verification server and exfiltrated all IDs as they passed through

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#34

Post by walrus01 » Wed, Sep 02, 2026, 4:58 AM UTC

ungreased0675 wrote: post #23

Bankrupt this company to serve as a warning to others that hang on to way too much data.

In addition, actual federal prison time for the C-levels would help as a deterrent to future fuckery.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#35

Post by rio517 » Wed, Sep 02, 2026, 5:04 AM UTC

I am so jaded, i cannot help jumping to the conlusion that to me they wanted to data to continue voter supression efforts.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#36

Post by charcircuit » Wed, Sep 02, 2026, 5:07 AM UTC

cute_boi wrote: post #5

I don’t know why the government allows websites and these craps to collect sensitive information like driver’s licenses and Social Security numbers. They could simply provide an API that allows websites to verify someone’s identity using a zero-trust approach without exposing the actual documents.

Because physical business are also allowed to collect this information.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#37

Post by 3RTB297 » Wed, Sep 02, 2026, 5:12 AM UTC

fishfasell wrote: post #2

So an online identity verification service had millions of IDs exfiltrated, many of which were linked to marijuana dispensaries? Oh man, my ID is definitely out there, shit.

From the article, it's some national-chain hotels, car rentals, casinos, dispensaries, and a couple maybes like if you bought alcohol at Target and they scanned your ID or sent something via FedEx that required an ID scan. Your ID might be scanned and in there multiple times.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#38

Post by tgsovlerkhgsel » Wed, Sep 02, 2026, 5:16 AM UTC

htrp wrote: post #29

It was probably Hertz that was the source of the breaches.

Hertz or the company Hertz uses

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#39

Post by tgsovlerkhgsel » Wed, Sep 02, 2026, 5:19 AM UTC

If there was some kind of fixed minimum compensation - even a single dollar per affected person - and strict liability (doesn't matter how you allegedly did everything to protect the data, if it leaked it's on you), companies would suddenly be very motivated to a) secure b) minimize the data they hold.

Without penalties, e.g. Hertz has little reason not to keep 10+ years of drivers licenses just in case they come in useful in a fraud case or as ML training data later. If having the data was a $153 million liability, they'd think twice.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#40

Post by mindslight » Wed, Sep 02, 2026, 5:19 AM UTC

Nition wrote: post #15

samlinnfer wrote: post #13

Earlier quoted context omitted.

The whole point is they keep it forever. You think any id verification services actually delete the data?

I mean, just because all your friends are jumping off a cliff...

It feels like we need to tweak the analogy for the surveillance industry. Something more like if all of your friends are pushing people off a cliff...