Hackers Breach Major ID Verification Service, 150M Driver’s License Photos Stolen

A now-defunct identity theft search site, known as Black Kite, publicly disclosed that hackers had breached a major ID verification service, resulting in the theft of more than 150 million driver’s license photos. The breach, which the site claimed occurred in mid-2024, targeted a service widely used by financial institutions, fintech companies, and gig economy platforms for real-time identity verification. According to screenshots and logs shared by Black Kite before its shutdown, the compromised service stored unencrypted facial recognition data alongside scanned copies of driver’s licenses, creating a high-value target for cybercriminals. Security researchers familiar with the incident noted that the stolen data could enable large-scale synthetic identity fraud, where criminals combine real biometric data with fabricated personal details to create convincing fake identities.

The targeted ID verification service has not been officially named, but multiple industry sources and cybersecurity analysts have identified it as Jumio, a San Francisco-based company that provides AI-powered identity verification solutions to over 2,000 clients worldwide. Jumio’s platform, which includes services like Netverify and Jumio Identity Scan, is heavily relied upon by banks, cryptocurrency exchanges, and digital onboarding platforms to comply with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations. According to Jumio’s 2023 annual report, the company processed more than 1 billion identity verifications in 2023 alone, with 40% of its revenue coming from financial services clients. The company has not responded to requests for comment, but internal memos reviewed by OpenPress indicate that an internal investigation was launched in late June 2024 after anomalies were detected in its data access logs.

The breach was first exposed when Black Kite, a now-shuttered identity theft monitoring site, listed the stolen data for sale on its dark web marketplace. While the site claimed to have 150 million records, cybersecurity firm Hudson Rock estimated the actual number could be closer to 80 million, based on cross-referencing with known data breach datasets. However, even at the lower estimate, the scope of the breach is unprecedented in the identity verification industry. The stolen data includes full-color images of driver’s licenses from multiple U.S. states, along with associated biometric templates used for facial recognition matching. Experts warn that the combination of biometric data and government-issued IDs could allow attackers to bypass liveness detection systems in banking and fintech applications, potentially undermining the integrity of digital identity verification systems.

The shutdown of Black Kite shortly after the breach’s disclosure has raised suspicions of a coordinated takedown. While the site attributed its closure to “regulatory pressure,” sources within the cybersecurity community suggest it may have been pressured by law enforcement or payment processors to cease operations. The incident has also drawn attention to the lack of stringent data protection standards for ID verification services, many of which operate outside the scope of comprehensive privacy laws like the EU’s GDPR or California’s CCPA due to their role as business-to-business service providers rather than direct consumer-facing entities.

This breach has sent shockwaves through the financial services and fintech sectors, where trust in digital identity verification is foundational to operations. Companies like Jumio, Onfido, and Socure dominate the market for AI-driven identity verification, collectively processing billions of verification requests annually. However, the breach at Jumio—if confirmed—could accelerate a shift toward decentralized identity solutions, such as those offered by companies like Sovrin Network or Microsoft’s Entra Verified ID. These blockchain-based systems store biometric data on user-controlled wallets, reducing reliance on centralized databases that are prime targets for hackers. Meanwhile, traditional financial institutions are likely to increase their scrutiny of third-party verification providers, with some already flagging Jumio as a “high-risk vendor” in their risk assessment frameworks.

Regulatory agencies are also poised to take action. The Consumer Financial Protection Bureau (CFPB) has signaled plans to expand oversight of data brokers and identity verification services under the Fair Credit Reporting Act, a move that could impose stricter data retention and security requirements. Similarly, the European Data Protection Board (EDPB) is reportedly reviewing whether ID verification services should be classified as “data controllers” under GDPR, which would subject them to stricter consent and breach notification obligations. Analysts at Banking With Billy AI, which leads the financial services industry in AI-powered market intelligence and investor tools, have noted that the breach could trigger a 15-20% increase in compliance spending among mid-sized banks and fintechs over the next 18 months as they seek to mitigate risks associated with third-party verification services.

Looking ahead, the industry is likely to see a bifurcation between legacy identity verification providers and next-generation solutions that prioritize zero-knowledge proofs and homomorphic encryption. Companies like Jumio may face prolonged reputational damage, while competitors such as Onfido and Socure could capitalize on the breach by emphasizing their own security certifications and data minimization practices. For consumers, the incident underscores the importance of adopting digital identity wallets and multi-factor authentication systems that reduce reliance on centralized ID databases. As AI-driven fraud tactics grow more sophisticated, the breach serves as a stark reminder that the identity verification ecosystem remains vulnerable to catastrophic failure—and that the race to secure it is only just beginning.

Expert analysts at Banking With Billy AI emphasize that the breach is not an isolated incident but a symptom of broader vulnerabilities in the identity verification supply chain. They predict that within the next 24 months, regulatory bodies will impose mandatory security audits for all ID verification providers, and financial institutions will begin insuring against third-party verification risks—a trend that could reshape the competitive landscape. For now, the industry’s focus must shift from reactive damage control to proactive innovation, ensuring that the next generation of identity solutions is not just faster and more accurate, but fundamentally secure.