Until pretty recently drivers license ID numbers in many states were effectively public, and if your license was issued at least 10 years ago, it probably still is.
> "Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements...
> 2. Driver's license number or California Identification Card number.
https://en.wikipedia.org/wiki/California_Senate_Bill_1386_(2...
Imagine if, until relatively recently, a social security number was a truncated MD5 hash of your name and birthday. That's the flavor of the problem here.
Perhaps it's making the same mistake as SSNs in that people use public or easily generated information to verify identity in the first place.