An ID Check Breach Timeline: 2011–2026

Key Takeaways

• We documented 88 incidents since 2011 in which data collected specifically to verify identity or age was breached, exposed, or put up for sale — affecting at least 2.15 billion records on a confirmed or researcher-verified basis, with attacker- and seller-claimed figures adding a further 4.54 billion.
• 42% of all incidents (37 of 88) date from January 2024 to August 2026, the period in which mandatory identity verification spread fastest. The rate is accelerating alongside the mandates.
• In 41 of the 88 incidents, what leaked included the actual documents: ID scans, verification selfies, fingerprints, biometric templates. Unlike a password, none of that can be changed.
• Every major identity-verification vendor from the current era — AU10TIX, IDMerit, Sumsub, Persona, inVOID — has appeared in this timeline. The companies the internet now relies on to hold everyone's identity documents safely haven't demonstrated they can do it.

Every year, more of the internet demands that you prove who you are before you may use it: KYC checks to open an account, a driver’s license to join a dating app, a passport scan to check into a hotel, a face scan to read an adult site in the UK, a government ID to appeal a Discord ban. 

Every one of those checks creates a copy of the most permanent data you have. This timeline compiles what happened to those copies.

We found 88 publicly documented incidents since 2011 in which data collected specifically to verify identity or age – government ID scans, verification selfies, biometric templates, KYC files, national ID registries – was breached, exposed, or put up for sale. 

On figures with a confirmed or researcher-verified basis, at least 2.15 billion identity-verification records have been affected; attacker- and seller-claimed figures add a further 4.54 billion on top. In 41 of the 88 incidents, the leaked material included the documents themselves: the scans, the selfies, the fingerprints – data that, unlike a password, can never be rotated.

The timeline is accelerating exactly as verification mandates spread: 37 of the 88 incidents (42%) date from January 2024 through August 2026, the era of the UK Online Safety Act, US state age-verification laws, and mandatory KYC nearly everywhere. 

The incidents of this era make the argument by themselves: the Tea app’s verification selfies scraped onto 4chan; 70,000 government IDs from Discord users’ age appeals leaked through a support vendor; the identity-verification vendors themselves (AU10TIX, IDMerit, Sumsub, Persona, inVOID) turning up with exposed credentials, open databases, or breached support systems. Nobody had compiled this record in one place. Now it is one dataset, one row per incident, with sources.

The Numbers

2011–2016: The Warning Shots

The pattern was set before anyone said “KYC” in public: South Korea’s Nate/Cyworld breach put 35 million resident registration numbers in criminal hands (2011); the US Office of Personnel Management lost 21.5 million background-investigation dossiers and 5.6 million fingerprint sets (2015); Turkey’s civil-registry extract of ~49 million circulated freely (dumped 2016); the Philippines’ COMELEC voter database, with passport numbers, was published outright (2016). 

Each was treated as an anomaly. Collectively they demonstrated the base fact that identity registries concentrate exactly on the data that can't be reissued.

2017–2021: KYC Goes Mainstream, and Leaks With It

As exchanges and fintechs institutionalized identity checks, the checks themselves became the loot: Binance extortion dumps of KYC selfies (2019), BioStar 2’s 27.8 million biometric access records sitting in an open Elasticsearch (2019), India’s BuyUcoin, Upstox and MobiKwik KYC troves (2021), Argentina’s RENAPER national registry offered for sale (2021, government disputes scale). 

The Ecuador (Novaestrat) and Brazil mega-aggregations showed the broker side of the same machine.

2022–2024: Governments Lose the Master Files

Optus and Latitude turned Australian ID-check mandates into millions of exposed licence and passport numbers and forced national reform. Thailand, Indonesia, Bangladesh, the Philippines police, Paraguay and El Salvador each lost citizen-scale registries – El Salvador’s dump included 5.1 million facial photos. India’s ICMR/Aadhaar-linked listing claimed 815 million. 

The US saw its background-check industry breached at scale (National Public Data, 272 million verified records).

By the end of 2024, the question was no longer whether national identity stores leak, but which one is next.

2025–2026: The Age Verification Era

Then the laws arrived that made showing ID a condition of ordinary internet use – and the incidents followed within months. The Tea app’s women-only verification selfies were scraped from an open bucket and sorted into sleazy rating threads on 4chan (July 2025).

Discord users who appealed age decisions had ~70,000 government IDs leak through a third-party support vendor (October 2025) – while Discord rolled age checks out globally anyway. 

Japan’s Omiai had already shown the shape of it in 2021: 1.7 million age-verification document images. And the verification industry itself joined the timeline: AU10TIX (verifier for TikTok, Uber, X) left admin credentials exposed for over a year; IDMerit was reported with ~1 billion identity records reachable in an open database (disputed by the company, flagged as claimed); Sumsub disclosed an 18-month-undetected support-system intrusion; Persona, Discord and Roblox’s age-verification vendor, exposed its own frontend configuration; France’s ANTS (the agency that issues French IDs) was breached with 11.7 million people confirmed affected. 

The pattern of this era is specific: the wall you are forced to hand your ID to is exactly as breachable as everything else on the internet.

The Timeline

• * = record figure is attacker- or seller-claimed.  
• AV = age-verification-related. 
• “vendor” = capability exposure with no confirmed personal-data leak. 

What This Record Shows

The timeline makes something visible that individual breach reports obscure: this isn't a series of unrelated failures. It's one failure mode, repeated across 88 incidents, fifteen years, and every type of organization that has ever decided to collect this category of data.

What varies is the victim. Sometimes, it's a startup with inadequate security. Sometimes, it's a national government that built a country-scale identity registry and watched it walk out the door. Sometimes, it's a verification vendor that became the single point of failure for a dozen companies that outsourced their compliance obligations to them. 

The mechanism stays constant: concentrated, irreplaceable, maximum-sensitivity data in a place that eventually gets breached.

The policy context matters here. The incidents in this timeline aren't a bug in the age-verification system. They're the predictable output. Every law that makes identity checks mandatory, every platform that adds an ID gate, and every verification vendor that builds a centralized database creates a new target.