From the article:

“it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana.”

Worth noting that 5 US states (e.g. Florida) have stopped issuing standard drivers licenses and effectively force their residents to obtain a “Real ID” which includes additional data – which of course makes more sensitive data available to cybercriminals.

(edit) BTW, would be useful to have a free-world venue for posts just about data breaches. Proposal here.