No idea why they were collecting identification then.

Even worse, since the hackers got a bunch of the data at once, the company must have held onto those pictures long after they registered people to their service, which they likely didn't need to do.