As reported by SecurityAffairs, a new Mysterium VPN report cataloging 88 identity-verification breaches since 2011 paints a damning picture of an industry that has expanded faster than its security maturity. The confirmed 2.15 billion exposed records — with an additional 4.54 billion under attacker claims — represent what may be the most concentrated accumulation of non-revocable personal data ever breached.

Key Takeaway: As reported by SecurityAffairs, a new Mysterium VPN report cataloging 88 identity-verification breaches since 2011 paints a damning picture of an industry that has expanded faster than its security maturity.

The Irrevocability Problem Changes the Risk Equation

The report's most significant finding is buried in the breakdown: in 41 of 88 incidents, the leaked material included source documents — ID scans, verification selfies, fingerprints, and biometric templates. This is the detail that separates identity-verification breaches from ordinary data exposures. A compromised password is a transient problem. A leaked government ID scan paired with a liveness-check selfie is a permanent one. That combination enables synthetic identity fraud, credential stuffing via reused document data, and social engineering pretexts that can defeat secondary authentication for the victim's entire lifetime.

The companies the internet now relies on to hold everyone's identity documents safely haven't demonstrated they can do it.

This is not hyperbole from the report — it is an observable pattern. AU10TIX, which sits in the verification path for TikTok, Uber, and X, left admin credentials exposed for over a year. Sumsub's support-system intrusion went undetected for 18 months. These are not edge-case misconfigurations; they are foundational security failures at vendors whose entire value proposition is trust.

Regulatory Pressure Is Creating the Exposure

The acceleration is telling: 42% of the 88 incidents occurred between January 2024 and August 2026, precisely as age-verification and KYC mandates proliferated globally. This is the predictable outcome of regulatory pressure outrunning technical safeguards. When governments mandate identity checks, platforms rush to bolt on third-party verification without conducting adequate due diligence on the vendor's security posture. The result is a supply chain where a single compromised vendor cascades across dozens of consumer platforms.

The Discord case illustrates this perfectly: users who challenged age-verification decisions had approximately 70,000 government IDs exposed through a third-party support provider — not even through Discord's primary infrastructure. The attack surface extends to every subcontractor in the verification workflow.

Centralized Identity Registries Are Strategic Targets

Government systems are not exempt. Argentina's national identity system leaking 45 million records demonstrates that centralized biometric registries — however well-intentioned — create single points of failure with national-scale consequences. Nation-state actors and organized criminal groups recognize this. A breach of a national ID database is not just a privacy incident; it is an intelligence windfall that enables cross-border identity fraud for decades.

Shield53 Recommendations

For Organizations Consuming Identity Verification Services

Centralized Identity Registries Are Strategic Targets
Conduct vendor security due diligence before integration. Require SOC 2 Type II, ISO 27001, and evidence of biometric data handling certifications. Ask specifically about data retention policies, encryption at rest with customer-managed keys, and subprocessor lists.
Minimize what you transmit. If you only need an age assertion, do not send full ID images to the vendor. Use tokenized verification flows where the vendor returns a boolean or attribute claim rather than storing the document on your behalf.
Contractually mandate breach notification timelines. 18 months of undetected intrusion is unacceptable. Require 72-hour notification, independent annual penetration tests, and the right to audit.
Map your full verification supply chain. Identify every subprocessor, support tool, and storage bucket in the workflow. The Discord incident shows the exposure often lives in the support layer, not the primary API.

For Verification Vendors

  • Treat biometric data as toxic inventory. Implement data minimization by design — delete source documents after verification completes unless explicit, revocable consent for retention exists.
  • Adopt zero-trust architecture for internal systems. Exposed admin credentials and undetected support-system intrusions indicate basic access control failures. Enforce MFA on all privileged accounts, implement session monitoring, and deploy continuous threat detection.
  • Segment verification data from support infrastructure. Support agents should never have filesystem access to raw ID documents. Use redacted views and time-limited access tokens.

For Policymakers

  • Pair identity mandates with security standards. Requiring age verification without requiring the verification provider to meet a defined security baseline is legislative malpractice. Mandate periodic third-party audits and minimum encryption, retention, and incident-response standards.
  • Consider decentralized verification models. Zero-knowledge proofs and age-assertion tokens that do not require centralized document storage can satisfy regulatory goals without creating the honeypots this report documents.

The fundamental issue is architectural. Centralized storage of non-revocable identity documents creates permanent risk for transient verification needs. Until the industry shifts toward verification-without-retention and policymakers demand security standards alongside identity mandates, the breach count will continue its current trajectory. The 88 incidents in this report are not a historical record — they are a leading indicator.