KYC Leaks

Revolut said attackers used fraudulent requests sent from legitimate government-agency email accounts to obtain sensitive customer information. The company described the affected group as limited but did not publish a count.

IDScan.net confirmed unauthorized access to customer information after a criminal service advertised more than 153 million driver's-license records. The 153 million figure is a reported record count, not a confirmed count of unique people.

SafePal said an authorization flaw in an order-tracking plug-in allowed external access to customer order information. Approximately 39,798 customers were affected. The company said wallet credentials, payment-card data, government ID numbers, and customer funds were not involved.

Trezor said unauthorized access at fulfillment partner ShipMonk exposed customer delivery data. Its updated disclosure put the total at 80,689 customers, including about 67,000 older US orders that ShipMonk had previously said were deleted. Wallet devices, backups, and Trezor systems were not compromised.

The US auto insurer said attackers used compromised employee credentials to steal personal information and driver's-license numbers. The published 6.99 million figure is a people count, so no separate document total is inferred.

A breach of systems used for hunting and fishing licenses exposed identity information belonging to more than three million customers. Public reporting described the figure as people affected, not a count of identity documents.

An exposed storage system used by a private UK visa-processing service contained at least 100,000 passport and selfie files. The number of unique applicants represented by those files was not confirmed.

A hotel check-in platform left more than one million identity documents and verification images accessible online. No reliable count of unique hotel guests was published.

France's agency for secure identity documents confirmed a breach. A criminal claimed 19 million records, but the agency did not confirm that figure, so both people and identity-document counts remain unknown here.

The Canadian money-transfer app exposed a cloud bucket containing more than 360,000 files, including KYC documents and selfies. The mix of files and number of unique people were not confirmed, so no identity-document total is inferred.

Ledger customers were included in a breach of payment and ecommerce partner Global-e. Customer contact and order data—including the hardware-wallet product purchased—was accessed, but no reliable affected-customer total was published. Payment information, recovery phrases, and government IDs were not involved.

Eurail said attackers accessed customer and pass-holder information. The published figure is the number of affected people; reports said passport photocopies were not part of the stolen data.

A compromised customer-support provider exposed data submitted to Discord support. Discord identified approximately 70,000 users who may have had government-ID photos exposed during age-related appeals.

Prosper said attackers queried databases holding customer and applicant data between June and August. Its notice listed extensive identity and KYC fields but did not publish an affected-person or identity-document count.

The women-only dating-safety app disclosed an exposure of 72,000 images. About 13,000 were selfies or selfies paired with photo IDs submitted for account verification; that narrower figure is used here.

LexisNexis disclosed that an attacker accessed a third-party development platform and obtained sensitive consumer information. Data varied by person, so the people count is not converted into a license-record count.

Coinbase said support contractors were bribed to retrieve customer data, including government-ID images and financial account information. The affected-customer count does not establish how many ID images were taken.

A gift-card marketplace exposed more than 600,000 KYC image files associated with roughly 200,000 customers. Multiple files could belong to one person, so the two published figures remain separate.

An exposed cloud-storage system associated with the roommate-matching service contained roughly 320,000 passport and driver's-license files. A unique-person count was not published.

A ransomware intrusion exposed customer information held by Evolve and its fintech partners. The published notice count is affected people, not identity documents.

LSEG said data originating from its World-Check risk-intelligence service was obtained through a third party. The 5.3 million figure came from the threat actor and may include organizations as well as people, so it is not included in the aggregate.

A January ransomware incident exposed mortgage customers' sensitive identity and financial data. The regulatory notice reports affected people, not a number of identity documents.

The MOVEit attack exposed records held by Louisiana's motor-vehicle agency. The widely reported six-million figure refers to credential records, not a verified count of people or document images, and is excluded from the aggregate.

Oregon's motor-vehicle agency said the MOVEit breach affected approximately 3.5 million holders of Oregon driver's licenses or identity cards. That is a people count, not a document count.

Latitude reported approximately 7.9 million driver's-license numbers and 53,000 passport numbers stolen, plus 103,000 document copies. The aggregate uses only the two non-overlapping number categories and does not add the copies again.

Optus disclosed a breach affecting current and former customers. Published totals describe customer records; because only a subset contained identity-document fields, no document total is inferred.

A threat actor claimed access to Argentina's national identity registry. RENAPER denied a mass database breach and attributed published samples to misuse of an authorized government credential, leaving the true number affected unconfirmed.