You’ve done it. We all have. You’re trying to open a bank account, or maybe you’re ordering from a legal marijuana dispensary, and the app asks for a photo of your driver’s license. You think, “This is for safety. This is to stop fraud.” So, you snap a picture, upload it, and forget about it.
Well, the FBI is currently probing an identity verification service that just leaked over 153 million driver’s licenses. If you’ve ever handed your ID to an online service, your face, your signature, and your address are likely sitting in a database you didn’t know existed, held by a company you never chose to trust.
The same database that proves you are you is the exact database a hacker uses to become you.
Verification and identity theft are just two sides of the exact same database. We’ve been sold a lie that hoarding sensitive documents makes us safer. It doesn’t. It creates a massive, high-value honeypot for criminals. The more robust these verification services try to be, the larger the target they paint on your back.
Look at the people realizing they are compromised right now. One user realized their dispensary ID was definitely exfiltrated. Another asked the million-dollar question: Why didn’t the company just delete the data after verifying them? Why did they decide to keep 153,347,439 licenses?
Retention isn’t a bug in the verification system—it’s the entire business model.
Here is the twist nobody in the tech industry wants to talk about: The technology to fix this already exists. We do not need companies storing raw images of your driver’s license. A government-backed, zero-knowledge API could easily allow websites to verify your identity without ever exposing the actual document. The website asks the API, “Is this person over 21?” and the API returns a simple “Yes” or “No.” No photo stored. No address leaked. No honeypot created.
So why isn’t this the standard? It’s not a technical limitation. It’s because your raw data has become a business asset. These companies are harvesting your most sensitive documents, packaging them, and monetizing them under the guise of “security.” They are facilitating mass fraud while telling you they’re making the world safer.
They don’t want to verify you. They want to own you.
Neutrality is death in the face of this absurdity. This isn’t just a breach; it’s a systemic failure of incentives. We are handing over the keys to our lives to faceless middlemen who suffer zero consequences when they inevitably leave the front door wide open.
So, what do you do? You stop trusting the system. Assume any identity document you’ve uploaded is already compromised. Lock your credit right now. Enable your mobile carrier’s protections against SIM swapping immediately. Stop volunteering your data to services that demand it without proving they know how to protect it.
Your identity is the only thing that is truly yours. Stop handing it over to the people building the world’s largest honeypots.
FAQ
Q: Don't these companies *need* to store my ID to comply with KYC laws?
A: No. Know Your Customer laws require verification, not indefinite retention. A zero-knowledge API can prove identity to the government's standards without the company ever storing the raw document. Retention is a business choice, not a legal mandate.
Q: What's the practical implication if my license is in that database?
A: Assume you are now a victim of identity theft. Someone has your face, address, and license number. Lock your credit, freeze your SSN, and secure your mobile carrier account against SIM swapping immediately.
Q: Is the government intentionally allowing this to happen?
A: The government isn't malicious here, just incompetent and lazy. By allowing private companies to hoard licenses, the state gets a massive, searchable database of citizen biometrics without technically violating the 4th Amendment. It's surveillance by proxy.