The ID Scan Breach and the Case Against Storing Documents

A verification artefact is the evidence an identity check leaves behind: the scan, the selfie, the liveness capture, the timestamp confirming a document passed inspection. On 31 August 2026 a dark web service appeared on a Russian-language cybercrime forum offering more than 153 million driving licence scans, alongside roughly 10 million identity cards, 3 million travel documents and 579,000 medical cards. The FBI has confirmed an inquiry. The service has since gone offline.

The volume is not the interesting part. The composition is.

Key takeaways

• The listing reportedly included infrared and ultraviolet captures alongside standard images, plus verification timestamps showing when each document passed a check.
• Those are not ordinary photographs. They are the exact artefacts a document authentication system produces, and the exact artefacts it inspects.
• Independent reporting confirmed sample records were accurate, including those of serving public officials.
• The material was allegedly held by an identity verification provider, meaning the data was assembled in the course of preventing fraud.
• The structural lesson is not "encrypt better." It is that a verification system which retains its own evidence becomes the highest-value target in its own threat model.

Why infrared and ultraviolet captures change the severity

Most identity breaches leak information about a document: a licence number, a date of birth, an address. That material supports impersonation, but a competent verification check will still reject a forged physical credential.

Multi-spectrum captures are different. Modern document authentication works by illuminating a card under ultraviolet and infrared light to reveal security features that are invisible in ordinary photographs — embedded patterns, ghost images, retroreflective layers. A system that holds those captures holds a template of precisely what a genuine document looks like under inspection.

The verification timestamp is the quietest and most corrosive item on that list. It converts a stolen record into something that looks like an established, previously-approved customer.

The retention default nobody chose

Almost no organisation decides to build a document archive. They accumulate one, for reasons that are individually defensible:

Audit and regulatory evidence. Anti-money-laundering supervision expects a firm to demonstrate it performed the check. Keeping the artefact feels like the safest way to prove it.

Dispute resolution. If an account is later contested, the original evidence is the tiebreak.

Re-verification economics. Re-running a check costs money. Retaining the result avoids paying twice for the same customer.

Model improvement. Captured documents are training data for fraud detection.

Each rationale is reasonable. Together they produce a permanent, growing store of the most forgery-useful data an organisation will ever handle — held by a party whose core competency is verification, not custody.

The obligation is usually to prove that a check occurred and produced a result. It is rarely to retain the raw artefact indefinitely. Those two things get conflated, and the second is what breaches.

Separating the proof from the evidence

The architectural fix is older than the problem. Split the parties: an issuer verifies once and issues a credential; a holder keeps that credential; a verifier confirms an assertion without receiving the underlying material.

Under that model the questions a business actually needs answered — is this person over 18, are they a real and unique human, do they hold a valid residency status — are answered by a cryptographic proof rather than by transmitting a document. The verifier learns the answer. It never takes custody of the evidence, so it has nothing to lose in a breach and nothing to retain under a data protection regime.

AIR Identity implements this with zero-knowledge proofs: a partner confirms an attribute is true without receiving the document, the biometric, or the underlying personal data. The verification result is portable, so a user proves the same fact to the next service without a second document capture, and no additional copy of the artefact comes into existence.

For businesses acquiring users at volume, that changes the risk arithmetic. A verified user acquisition flow that never takes possession of a document cannot leak one. The same holds for publishers and communities, where the practical requirement is usually an attribute — an age band, a jurisdiction, a unique person — rather than a full identity dossier.

This is the concrete version of the argument set out in our earlier piece on biometric data retention as a liability. The theory has now been demonstrated at a scale of 153 million records.

What to review this quarter

Inventory what verification data you retain, and for how long. Most organisations discover the answer is "everything, indefinitely" because no deletion rule was ever written.

Separate the audit record from the artefact. A signed attestation that a check was performed, by whom, against which standard, and with what outcome usually satisfies the supervisory requirement without keeping the image.

Ask your providers what they store on your behalf. Liability for a processor's retention does not stay with the processor. Contractual clarity here is cheaper than the alternative.

Treat multi-spectrum captures as a distinct data class. They deserve stricter handling than a document photograph, because they compromise the integrity of future checks rather than the privacy of past ones.

Test whether an attribute would do. For a large share of verification decisions, the business needs a yes or no, not a document. Every case where an attribute suffices is a case where nothing needs to be stored.

Frequently asked questions

What was in the 153 million driving licence listing?

The service offered scans of more than 153 million driving licences, approximately 10 million identity cards, 3 million travel documents and 579,000 medical cards. Reporting indicates the files included infrared and ultraviolet captures as well as standard images, together with timestamps recording when each document was verified.

Why are infrared and ultraviolet document scans more dangerous than photographs?

Document authentication systems inspect security features that are only visible under ultraviolet or infrared illumination. A leaked multi-spectrum capture shows what those features look like on a genuine credential, which supports the production of forgeries designed to satisfy an automated check rather than a casual visual inspection.

Can identity verification work without storing documents?

Yes. In an issuer-holder-verifier model, a trusted party verifies the document once and issues a credential to the individual. Subsequent services receive a cryptographic proof of the specific attribute they need. They confirm the assertion without receiving or storing the document.

Does anti-money-laundering law require firms to keep identity documents?

Record-keeping obligations generally require evidence that customer due diligence was carried out and what it concluded. That is usually satisfiable with a signed, auditable attestation rather than indefinite retention of the raw scan. Firms should confirm the position with their own supervisor, since requirements vary by jurisdiction.

What is a verification timestamp and why does it matter in a breach?

It is a record showing that a particular document passed a particular check at a particular time. In a breach it is unusually damaging, because it lets stolen material be presented as belonging to an already-approved, established customer rather than a new and therefore more closely scrutinised applicant.

Related reading

• Biometric data retention is a liability
• Synthetic identity and injection attacks in 2026
• Why biometrics alone are no longer enough

More from AIR: AIR Identity, verified user acquisition, or browse the full AIR blog.

Reviewing what your verification stack retains? See how AIR Identity confirms attributes with zero-knowledge proofs so no document copy is created, or read the developer documentation.