153M driver’s licenses leaked, KYC practices under fire

Security researchers and privacy advocates this month reported a dataset containing 153 million driver’s license records was exposed. Law enforcement and data-security specialists are investigating the origin of the files and the party responsible for the leak.

The dataset is reported to include names, license numbers, dates of birth, residential addresses and images of the ID cards. Those data elements are commonly used for identity verification and can be used to open accounts, commit fraud or create synthetic identities if abused.

Companies that use digital know-your-customer identity checks-including banks, fintech firms and cryptocurrency platforms-faced immediate pressure after the disclosure. Consumer groups and privacy-focused organizations urged firms to pause bulk ingestion of government ID images and to stop retaining raw ID files once verification is complete.

Several financial platforms announced reviews of their verification processes. Some restricted new user onboarding and increased manual review to reduce automated handling and storage of sensitive images while investigations proceed.

Privacy advocates called for limits on how long government ID images are kept and for stronger encryption and access controls where retention is required. They highlighted that many verification flows run through third-party vendors, and that vendor contracts and storage practices can affect how widely records are exposed.

Regulators are assessing whether existing consumer-protection and data-security laws cover harms that follow large-scale exposures of identity documents. Lawmakers in multiple jurisdictions requested inquiries into identity-verification vendors and platforms that collect government IDs to determine who retained the records and why. Investigations are expected to examine contractual arrangements, data-retention policies and whether security measures met industry standards.

Security advisors and identity-protection services issued guidance for people whose documents may be in the dataset: monitor credit reports, place fraud alerts or credit freezes where available, and be vigilant for phishing attempts that use leaked ID details. Several identity-theft remediation firms said they are preparing extended monitoring and assistance programs for impacted individuals.

Industry groups and cybersecurity firms outlined technical options that would reduce reliance on raw ID images. Proposed approaches include verification tokens, zero-knowledge proofs and decentralized identity systems that allow users to prove attributes without handing over original documents. Firms also recommended stronger encryption, tighter key management and limiting third-party data sharing.

Platforms and regulators said they are working to identify the full scope of the exposure and to notify potentially impacted people where contact details exist. Future policy discussions are expected to focus on verification methods that require less intrusive data collection and on potential regulatory requirements for safer identity checks.