Curiously, the identity records include not only drivers licenses but also marijuana dispensary cards

Yeah, this is why I refuse to buy from dispensaries that scan my ID card in any way.

If you want to see it with your eyes, that's fine. I have no problem authenticating with a human. But as soon as you want to put it in front of a camera lens, that's me walking out the door.

the timestamp on my license scan corresponds to a date in June 2025 when I took a flight to the midwest United States to attend a family funeral

Jesus fuck. I guess that's something you can't opt out of? I want to know who took that photo: the airline or TSA.

Edit:

first, I thought the source of the data might have something to do with airports. However, that theory went out the window when it became apparent there were no passports in this data set
...
from reviewing car rental records shared by several people...

Yeah, that makes more sense

The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit.

Oh wow, this person knows how to do marketing.

Email Brian Krebs a copy of their license, and you're gonna get some serious traffic.

Can we get eIDs now, please?

Edit: this could be done poorly, so let me clarify that we need government issued smart cards used for cryptographic authentication, which would deprecate photos of KYC documents as a method of auth.

Is this Elon Musks side hustle?

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States...

lol

...and Canada

Fuck

That's crazy that they gave Hegseth his drivers license back after "the incident".

This nonsense of sending passports is just ridiculous. Users don't want to send it, and websites don't want to have them - it just makes them a bigger target for these kinds of hacks.

Luckily the EU is working on a better solution to this that works on a zero-knowledge principle. Meaning the website doesn't get to know who you are, and the government doesn't know who's asking.

If you're going to need age verification (I don't like it, but I also agree it's inevitable for some things), this is a much, much less stupid way to go about it.

When a drivers license is for some reason used to identity people instead of simply implementing a proper method for that purpose...

Oregon DMV was one of the many MoveIt breach targets and all that juicy bio data (eye, hair, height, complexion, attached to DOB) is now floating in the ether. Probably my most frustrating breach notification. Can't even really sue my state despite their complicit incompetence.

So thrilled about my 12 months of data theft protection I was provided that ended several years ago. I assume data thieves stoped all activity with it long ago.