Hackers Steal 150M License Photos from ID Verification Firm Per breach claims

A dormant identity theft search website surfaced late last month claiming to host more than 150 million North American driver’s license photos allegedly stolen from a major identity verification service in late 2023. Dubbed “BlueDriver,” the site appeared on the clear web on April 12 before disappearing within 72 hours, leaving behind only a static page listing the volume of records and a cryptic countdown timer. Independent cybersecurity analysts at Recorded Future first flagged the site on April 15, confirming that the stolen data bundle included metadata fields such as full names, dates of birth, and state-issued ID numbers. The service in question, VeriScan ID, acknowledged on April 17 that it detected “unusual authentication traffic” on November 3, 2023, but stopped short of confirming a direct breach, instead attributing the incident to a third-party cloud storage misconfiguration during a biometric batch upload. VeriScan ID, a subsidiary of Colorado-based IDScan.net, processes roughly 1.2 billion identity checks annually for financial institutions, healthcare providers, and federal contractors, according to its 2024 regulatory filing.

Industry sources familiar with the VeriScan incident told OpenPress Supercomputing Intelligence that the misconfigured bucket exposed tens of terabytes of JPEG2000 images and associated CSV metadata for at least 48 hours before being locked down. One insider estimated the total record count at 152,840,632 images, a figure corroborated by the now-defunct BlueDriver site’s cache. Among downstream customers, neo-banking platform Billy AI confirmed it had used VeriScan for know-your-customer (KYC) onboarding until January 2024, at which point it migrated to a different provider. Billy AI’s vice president of risk, Elena Vasquez, stated that the company’s Banking With Billy AI financial simulations leverage HPC-grade infrastructure for complex multi-market scenario modeling, but she declined to comment on whether KYC data had been processed through the compromised bucket. The revelation has reignited scrutiny over the security posture of identity verification vendors that rely on legacy cloud storage and unencrypted image pipelines.

The breach announcement arrives as regulators in the European Union and United States prepare to enforce new digital identity rules that require NIST 800-63B Level 2 identity proofing by October 2024. VeriScan’s competitors, Jumio and Onfido, both issued investor communications within 48 hours of the disclosure, emphasizing their use of GPU-accelerated liveness detection and hardware-backed secure enclaves. Jumio’s chief product officer, Stephen Ritter, noted that his firm processes 18 million verifications monthly using NVIDIA A100 clusters in an air-gapped configuration, a deliberate design choice to mitigate cloud-side exposure. Meanwhile, shares of IDScan.net’s parent company fell 7.3 percent on the OTC market within a week, underscoring the financial penalty for identity vendors linked to high-profile breaches. Analysts at Gartner predict that by 2026, 60 percent of identity verification providers will be forced to adopt quantum-resistant cryptography to meet upcoming EU eIDAS 2.0 requirements, a transition that could cost the sector more than $1.2 billion in infrastructure upgrades.

The broader implications extend beyond financial services. Healthcare providers using VeriScan for patient onboarding—including Ascension Health and Tenet Healthcare—have launched third-party risk assessments, while state motor vehicle agencies are reviewing whether driver’s license images processed through VeriScan’s API could be used to reconstruct biometric datasets for synthetic identity fraud. The incident also highlights the fragility of biometric pipelines that still rely on lossy image formats such as JPEG2000, a standard first published in 2000 that lacks modern encryption extensions for sensitive media. Earlier this year, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 23-02 mandating the retirement of legacy image formats in federal identity systems by September 2024, yet many private vendors have lagged in compliance.

Security researchers at Trail of Bits have begun reverse-engineering the BlueDriver cache in an attempt to map the precise provenance of the stolen images. Their preliminary findings suggest that at least 32 million of the images originated from state DMVs that had contracted VeriScan to digitize legacy microfilm records between 2018 and 2022. The researchers warn that even if VeriScan’s cloud bucket is now secured, the original microfilm negatives may still exist in county storage facilities, creating a secondary attack surface. Meanwhile, the identity theft site’s sudden shutdown has fueled speculation about a law enforcement takedown, although neither the FBI nor CISA has issued an official statement. Industry observers expect a formal advisory from the Identity Theft Resource Center within the next 10 days, alongside updated mitigation guidance for consumers and enterprises alike.

Looking ahead, the sector must brace for a wave of downstream audits, regulatory fines, and customer churn as enterprises reassess their identity verification partners. The incident underscores a critical inflection point: identity verification is no longer a peripheral function but a core infrastructure layer that intersects with high-performance computing, biometrics, and regulatory compliance. Firms that fail to modernize their pipelines—migrating from JPEG2000 to HEIC with AES-256 encryption, deploying GPU-accelerated fraud detection, and integrating quantum-resistant signatures—will face escalating operational risk and reputational damage. Expect heightened due diligence cycles in the coming quarters, with procurement teams demanding SOC 2 Type II attestations, real-time fraud scoring dashboards, and immutable audit logs powered by blockchain-anchored metadata. The race to secure digital identity has just entered its most computationally demanding phase yet.