88 ID Verification Breaches Show the Cost of Collecting Identity Data
Brief
88 ID-verification breaches exposed billions of records, highlighting the growing risks of collecting sensitive identity and biometric data.
A new report from Mysterium VPN compiles 88 documented incidents since 2011 where data collected specifically to verify someone’s identity or age got breached, exposed, or sold. The confirmed and researcher-verified total sits at 2. 15 billion records, with attacker and seller claims piling another 4. 54 billion on top of that.
The most uncomfortable number in the whole dataset isn’t the total record count, it’s how much of it can’t be fixed after the fact. In 41 of the 88 incidents, what actually leaked included the source documents themselves: ID scans, verification selfies, fingerprints, full biometric templates. A password gets reset in thirty seconds. A face doesn’t.
The timing makes the report especially concerning.