The counter scan that cleared a customer for entry is now for sale by name

Handing a licence across a counter feels like showing something, not sending it. The reader beeps, the card comes back, and the customer's model of the event is that a person checked a birth date and moved on.

Teams buying that reader tell themselves a simple story: we verify age, we do not keep IDs. The plumbing tells a different one. A document gets scanned and parsed, a vendor returns a decision, and something derived from that document outlives the four seconds it took. For the suspicion Krebs raises to hold at all, data from scans like that had to sit somewhere after the check ^[3]. The seller's own pitch on the Russian-language forum Exploit describes more than a year of continuous collection into a private database ^[2].

The page count is the closest thing to an inventory anyone outside has. About 11.5 million pages at roughly 15 results each works out to something near 172.5 million records ^[10], around 13% more than the 153 million advertised ^[11]. That is why Krebs judged the seller likely not to be exaggerating ^[5]: the index is bigger than the sales copy. Pricing one cabinet secretary's licence at $100 ^[9] says the seller is charging by target, not by the record.

IDScan.net and the FBI did not immediately respond to PCMag, and Krebs says both are already investigating ^[6]. So the vendor link is suspicion with two data points behind it, not a confirmed disclosure, and PCMag's own framing stays conditional: the outlet called it, if real, one of the worst breaches in recent history ^[12]. The people who run the checkout do not get to wait for that resolution, because the customer email arrives before the incident report does.

A password can be rotated after a breach. A licence number and the face on a scan cannot be reissued the same way, so the remedy available to an affected customer is monitoring rather than repair, and that cost lands on them.

The grid worth running has two axes. First: does the check need the document, or only a claim derived from it, such as over 21 or name matches booking. Second: after the check, who holds the image, and for how long. A dispensary door or a game shop needs the claim. A rental desk handing over a car has a stronger argument that it needs identity. The expensive cell is a boolean requirement served by a document-retaining pipeline, where you carry the whole exposure of a government ID to answer yes or no.

The forcing function is narrower than a security review. What a company needs from the vendor is the retention period as it appears in the contract, plus a deletion record specific enough to paste into a reply to a named customer. If what comes back is a policy page, then the honest answer to that customer is that you do not know where their scan is, and the scanner at your counter is collecting on someone else's terms. The companies named on the client list ^[3] are working that out this week with counsel attached. Everyone with a smaller reader and the same plumbing is working it out through a support inbox.