The scary number isn’t 153 million. It’s zero — as in, zero organizations have put up a hand to say that was us.
According to KrebsOnSecurity, a new identity-theft service surfaced on the dark web this week selling scans of roughly 153 million driver’s licenses from the United States and Canada. Krebs interviewed multiple people whose licenses appear in the trove and confirmed the images are legitimate and accurate — their photos, their addresses, their real license numbers. The FBI has opened an investigation. And the source of the data? Unknown. No breach disclosed, no vendor named, no state DMV holding a press conference. Just tens of millions of government IDs, for sale, provenance blank.
Read that word again: scans. Not a CSV of names and DOBs. Digital images of the physical document — the face photo, the signature, the DL number, the address, the issue and expiry dates. This is the difference between someone knowing your license number and someone having a picture of your license good enough to pass a lazy human review. If your fraud team has ever accepted a phone snapshot of an ID as proof of anything, sit with that for a second.
Everyone’s about to tell you the same two things: freeze your credit, sign up for monitoring. Both get recommended in the same breath as if they’re the same tool. They aren’t. So I ran the personal side of this the way I’d test any control — I put freezes on at all three bureaus, lived with them for a week, and watched what broke. Then I scored them against each other on the things that actually matter when someone is walking around with a photo of your face and a matching license number.
Round 1 — Does it stop the attack, or just narrate it?
A credit freeze blocks new lines of credit from being opened in your name unless you thaw it first. It’s a lock on the door. Credit monitoring is a camera pointed at the door — it tells you after someone’s already tried the handle, sometimes days later.
With stolen license images in play, the realistic attack is synthetic-identity and new-account fraud: open a card, a loan, a phone plan, a utility account using your identity plus a convincing document. A freeze stops the credit-based version of that cold. Monitoring only emails you about it.
Freeze wins, decisively. Prevention beats a well-written incident report every time.
Round 2 — The 2 a.m. version of the problem
Here’s where monitoring’s fans have a point. A freeze does nothing about the fraud that doesn’t pull your credit file: someone filing a tax return as you, claiming benefits, taking over an existing account, or handing your license to a cop after a traffic stop they’d rather you own. That’s the 2 a.m. call — not “someone opened a Visa,” but “there’s a warrant with your name and my face is nowhere near it.”
Monitoring — the decent kind that watches beyond the three bureaus, into court records, change-of-address, and dark-web mentions — is the only one of the two that even glances at those. A freeze is blind to all of it.
Monitoring wins this round. Grudgingly. It’s still just telling you the house is on fire, but at least it’s watching more rooms.
Round 3 — Cost and the friction tax
Freezes are free by law at all three U.S. bureaus. Placing and lifting them costs nothing but a few minutes. Monitoring worth having usually costs money, and the free version bundled with every breach settlement is mostly a lead-gen funnel with a dashboard.
The friction is real, and I’ll be honest about it because the freeze evangelists never are: for a week I couldn’t instantly get approved for anything without remembering which bureau a given lender pulls, then thawing that one, then refreezing. Applied for a store card as a test — declined, thawed Equifax, reapplied, fine. It’s a papercut, not a wound. You feel it maybe twice a year.
Freeze wins. Free and low-friction beats paid and passive.
Round 4 — What it does about the thing that leaked
Neither of these fixes the actual exposure. Your license number is not your password — you can’t rotate it. In most places you can’t get a new license number just because it’s floating around a dark-web bazaar; you generally need evidence of actual misuse, and even then it’s a slog. The photo and signature are permanent. That’s the ugly part nobody selling you a $19.99 subscription wants to lead with.
So this round is a draw at zero. Both tools manage downstream consequences. Neither un-leaks the document. Push.
Verdict: freeze first, then monitor if you’ll actually read the alerts
Final tally — freeze takes rounds 1, 3, and edges the practical value; monitoring takes round 2. Freeze wins. If you do exactly one thing, freeze your credit at all three bureaus. It’s free, it’s preventive, and it directly counters the most likely monetization of this specific leak.
The one case I’d flip it: if you know you’re already in someone’s crosshairs — you’ve seen a fraudulent account, gotten a notice, or you’re in a class of people who get targeted — layer on real monitoring that covers court and identity records, not just the credit bureaus. And if you’re the type who lets alert emails rot unread in a folder, monitoring is theater. Buy it only if you’ll act on it.
Security experts also generally suggest, given the specifics here: pull your free annual credit reports and read them, watch for tax-filing and benefits fraud, and — because the source is unknown — contact your state or provincial DMV directly to ask whether they’ve issued any breach notice, rather than trying to hunt for yourself in a criminal marketplace. Don’t go looking for the service. Don’t try to “verify” your presence in it. If you’re worried you’re being impersonated, that’s a conversation for your DMV and local law enforcement, not a Tor browser.
The part that’s actually your job
If you build or run systems, the consumer advice isn’t your problem — this is: a driver’s license image is no longer evidence of anything. If your onboarding, KYC, account-recovery, or step-up flow accepts a photo of an ID as proof that a human is who they claim, you now have to assume the attacker has a pixel-perfect, genuine scan of your customer’s real license. Static document checks were always weak. This is the week to stop pretending otherwise.
Two postures, judged fast. Trust the document — matching an uploaded image against a template, OCR’ing the fields, calling it a day — is now defeated by design; the images in this trove are genuine. Trust a live human tied to the document — liveness detection, a selfie-to-photo match with anti-spoofing, or better, a cryptographic proof like a mobile driver’s license or a bank-grade verified credential — survives this leak, because a flat scan can’t blink, move, or produce a signed assertion. If you’re still on the first posture, that’s your remediation for this cycle.
Start by finding out where you’re even exposed. Most orgs have no idea how many customer ID scans are sitting in a support share, an S3 bucket, or someone’s OneDrive from a 2022 escalation. Report-only inventory first, before anyone touches a delete key:
On the Microsoft side, if you’re licensed for it, drive this with Purview sensitive-information types (there are built-in classifiers for driver’s license numbers per jurisdiction) and a DLP policy in test mode first, so you get the map before you get the alerts. The goal this cycle is knowing your blast radius and killing static-image trust in any flow that gates money or access.
Urgency, straight: for individuals, the freeze is a this-week move — free, fast, and aimed squarely at how this data gets cashed out. For organizations relying on ID photos as an authenticator, treating those images as burned is a this-cycle redesign, not a someday-maybe. The images are real, they’re out there, and the one thing you can’t do is issue everyone a new face.
