The six image files behind each record are the useful evidence. The entry for Krebs holds three front-and-back pairs: a plain scan, an infrared version and an ultraviolet version, with a date and time appended to each file [8]. Infrared and ultraviolet passes are how a reader inspects the security features printed into a licence. That points at capture hardware standing at a counter, inside a verification workflow, rather than at a copied DMV table.
The collection points do not resolve to one venue. No passports appear in the set, which is what ended the airport theory [9]. One person found in the index had not flown recently and had a Hertz rental running for several months around the date of their timestamp [10]. The index also carries marijuana dispensary cards [11] and records tagged "CDL" or "CAC", the second of which may mean Common Access Cards [12]. A rental counter and a dispensary have little in common on the surface, but both could plausibly route their identity checks through the same verification supplier.
The size claim holds up on arithmetic. A blank search returns roughly 11.5 million pages at about 15 results per page [13], which lands near 172 million indexed documents and puts the 170 million figure in the sales thread inside the range rather than above it [14]. Canada supplies about 1.1 million of the licences, under one percent of the total, with Ontario the largest single concentration at 473,673 records [20][24]. Listings grew by nearly 400,000 licences in 24 hours [15]. At that rate, 153 million licences take about 383 days to pile up [17], which sits close to the "over a year" of continuous exfiltration the sellers advertise [16]. The numbers are consistent with each other, but consistency is not the same as corroboration.
There is no CVE here and nothing to patch. The exposure sits with every firm that moved document capture to a supplier and never wrote down where the raw frames went afterward. The questions are which supplier performs the capture, whether it keeps the infrared and ultraviolet frames after the check passes, for how long, and whether the contract obliges it to notify you when its own image store is the thing that leaks. Krebs has not named the Louisiana company [25], so procurement records are the only place a buyer can look. The Bureau opening this out of New Orleans is at least consistent with a vendor sitting in Louisiana [26].
The shop lets a buyer preview a record with pertinent fields redacted and displays the customer photo where it has one [21]. The workflow is built to confirm a named target is in stock before the buyer spends money, which functions less like a data dump and more like a fraud pipeline.
