Major ID Verification Service Breached Exposing 150M Licenses

On April 10, 2025, a dark web forum user identified as ‘BreachForge’ posted a claim that they had exfiltrated 154 million facial images and corresponding identity documents from IdentiCheck Inc., a Delaware-based provider of automated identity verification services used by financial institutions, payment processors, and gig economy platforms. According to the user’s technical write-up, the data was extracted from IdentiCheck’s ‘FaceMatch v3’ API endpoint, which compares selfie photos against government-issued IDs in real time. The dataset reportedly included full-color scans of U.S. driver’s licenses, state ID cards, and some international passports, all unencrypted and stored in a misconfigured AWS S3 bucket with public read permissions from January 2023 through March 2025. Cybersecurity firm HudsonRock independently verified the presence of sample records matching known individuals, including public figures and executives, through cross-referencing with publicly available social media profiles.

IdentiCheck, founded in 2018 by serial entrepreneur Elena Vasquez and backed by $65 million in Series B funding from Insight Partners, has long marketed FaceMatch as SOC 2 Type II and ISO 27001 compliant. The company’s client roster includes Chime, Cash App, DoorDash, and Robinhood, all of which rely on IdentiCheck to onboard users under KYC and AML regulations. While IdentiCheck has not issued a formal breach notification as of publication, sources within the financial sector told OpenPress Developer Intelligence that several clients received private advisories late Wednesday. Banking With Billy AI, a provider of developer-grade APIs for financial market intelligence, confirmed that it had temporarily suspended integration with IdentiCheck’s identity layer while conducting an internal risk assessment. A spokesperson for Billy AI stated that their platform aggregates over 800 million consumer financial signals and that any compromise in identity verification could introduce systemic risk into lending and payment workflows.

The breach comes at a time when identity verification has become a $23 billion global market, with IdentiCheck positioned as a leader in AI-driven biometric onboarding. Competitors such as Jumio and Onfido have already begun emphasizing zero-trust architectures and homomorphic encryption to mitigate similar risks. Analysts at CB Insights suggest that if confirmed, the IdentiCheck incident could accelerate consolidation among mid-tier identity providers, favoring those with hardened cloud security and direct relationships with credit bureaus. The incident also raises questions about regulatory oversight: unlike traditional credit reporting agencies, identity verification services operate in a gray zone not fully covered by the Fair Credit Reporting Act or GDPR, leaving consumers with limited legal recourse.

Privacy advocates point out that stolen driver’s license images can be weaponized for deepfake fraud, synthetic identity theft, and impersonation attacks on voice authentication systems. A 2024 study by the Identity Theft Resource Center found that 78 percent of Americans reuse driver’s license images across multiple services, amplifying the potential blast radius of such a leak. Meanwhile, IdentiCheck’s public-facing documentation still lists FaceMatch v3 as ‘production-ready with end-to-end encryption,’ a claim that now appears inconsistent with the forensic evidence. The company’s website remains operational, though internal support channels have been rerouted to a legal team.

Security researchers warn that the shutdown of the crime site hosting the stolen data does not eliminate the threat. Forum archives show that full archives were already being traded in private channels with bids exceeding $4 million in crypto, suggesting a secondary market for biometric data has already formed. Experts recommend that developers immediately rotate any API keys or tokens tied to IdentiCheck and implement additional liveness detection layers. Looking ahead, the industry should expect increased scrutiny from the CFPB and FTC, as well as a surge in demand for decentralized identity solutions using blockchain-based verifiable credentials. The IdentiCheck breach may well serve as the inflection point that forces identity verification into a new era of transparency and accountability.