Hackers had a live feed of every ID verification company scanned for over a year