identity verification
19 articles with this tag
NTT Docomo online shop and My docomo breach (up to about 300,000 records): ID document numbers leaked — what customers should do
On November 4, 2026, NTT Docomo confirmed unauthorized access from outside to the Docomo Online Shop and My docomo, and from about 1:05 a.m. on November 5 it stopped procedures on both and began emergency maintenance. In its second report (November 5) the company said some customer information had leaked through unauthorized access before the maintenance, and in its third report (November 6) it put the number at up to about 300,000 records. For all affected customers the leaked data is name, date of birth and age; address, contact phone number and email address; the number of an identity document; mobile phone number and contract start date; and the rate plan, options and discounts. For some customers it also includes the name and contact details of a legal representative or procedure agent, the workplace or company name and address, the financial institution, branch, account number and account holder name, and information on a childcare support programme. The cause is given as unauthorized access from outside; the route and the exact scope and count are under investigation, no new leak has been confirmed, and the time of recovery is undecided. As of November 7, 2026, no fourth report was found. Our bottom line: a call or message that quotes your name, address or contract details is not proof it is from Docomo. Do not open links, do not give PINs, passwords or card details, and if an ID document number leaked, watch for fraudulent contracts.
IDARE data breach (129,659 people): balances, transaction history and some ID document numbers leaked — what users should do
On October 13, 2026, Fivot Inc. announced that its cashless app IDARE had suffered unauthorized third-party access that leaked personal data. A vulnerability in outside software the company used for customer support and other work was exploited, and data in the company's database was obtained on multiple occasions between August 10 and September 27. The people affected are the 129,659 who had registered by September 27, including those who had closed their accounts. For everyone, the leaked data includes phone number, email address, date of birth, user ID, display name, account settings and status, balance, transaction history, and the name and expiry date on the IDARE card. For some people it also includes the name, address, gender, purpose of use and ID document number submitted for identity verification, the last 4 digits of the IDARE card number, the first 6 and last 4 digits of a credit card registered for top-ups, the last 3 digits of a bank account registered for top-ups, the activation code for the physical card, and annual income and employer details entered for LADDER, a lending service that closed in October 2021. Login passwords, images of ID documents and faces, My Number, full card numbers, security codes, PINs and full account numbers were not involved. The company says no fraudulent transactions have been confirmed and that multi-factor authentication is required to log in. In its second report on October 21, it said no fraudulent transactions had been confirmed as of that date and set out prevention measures with deadlines (October 30 and November 30). A third-party investigation by an outside specialist organisation is expected to be compiled by late November to early December, and the company says it will publish the report when it is complete. This site's conclusion: the leaked data alone cannot be used to log in or pay, but a message that correctly states your balance or recent purchases is not proof it is genuine. Do not act on messages claiming to be IDARE, a card company or a bank through the channel they arrived on, and never give anyone your password, PIN, security code or authentication code.
Japan's online ID checks move to IC-chip reading (April 2027): what changes, and how users and businesses should prepare
An amendment to the Ordinance for Enforcement of Japan's Act on Prevention of Transfer of Criminal Proceeds (promulgated 24 June 2025, in force 1 April 2027) ends, in principle, non-face-to-face ID checks that rely on images or copies of ID documents for bank accounts and other covered transactions. Reading the IC chip in a driver's license or My Number Card, and the card's electronic certificates (JPKI), become the main methods. In-person checks also change to presenting the document and having its IC chip read. Mobile phone contracts made online already switched on 1 April 2026; in-store contracts follow from April 2027. On 9 October 2026 the Financial Services Agency, citing the current situation of repeated unauthorized access and leaks of customer data that included driver's license images, asked financial institutions to move to IC-chip reading without waiting for the effective date. This site's conclusion: a leaked image can be reused by anyone, but IC-chip reading needs the physical card and its PIN. Users should check their two license PINs and My Number Card PINs now; businesses should stop collecting and keeping document images.
Denmark CPR register misuse (about 8.8 million people): what was taken, and what residents and organisations that grant lookup access should do
On October 5, 2026, Denmark's Ministry of Research, Education and Digitalisation announced that unauthorized persons had misused a private Danish company's legitimate access to look up data in the civil registration system (CPR), and obtained names, addresses, CPR numbers and more for about 8.8 million registered people, including living, emigrated and deceased persons. The CPR holds about 11 million people. The CPR administration noticed on the evening of October 2 that there had been irregular activity during September, and stopped the company's access. Names and addresses of people registered with name and address protection were not included. According to Danish media, on October 9 the CPR administration reminded the 1,039 companies with lookup access of its security rules, and the minister acknowledged that security had not been good enough. Media also report that the password 123456 was used on lookup accounts; this has not been officially confirmed. This site's take: a caller who knows your name, address and CPR number may still be a fraudster. Residents should never share MitID details or one-time codes, and businesses should stop treating these three items as proof of identity.
If your Japanese driver's license data was leaked: what to do to prevent misuse (credit bureau alerts, reissue, where to get help)
A practical guide for people whose Japanese driver's license image or number was leaked by a company. The license number, name, date of birth and face photo cannot be changed by the holder, and a reissued license keeps the first 11 digits of its number (National Police Agency directive). At the same time, non-face-to-face identity checks for mobile phone and bank contracts are moving from sending document images to reading the card's IC chip (mobile phone online contracts from April 2026; transactions under the Act on Prevention of Transfer of Criminal Proceeds from April 2027, as scheduled). This site's take: there is no way to take leaked data back, so the core of the response is making sure you notice quickly if something is opened in your name. In practice that means registering an identity-fraud alert (honnin shinkoku) with all three Japanese credit bureaus (CIC, JICC and the Japanese Bankers Association's KSC), checking your own credit file, and ignoring messages that pose as the company that leaked the data. Reissuing the license and paid 'data deletion' services are low priority or useless.
Lashinbang data breach: ID document numbers and payout bank details may have leaked (no ID images) — what sellers should do
On October 1, 2026, Lashinbang Co., Ltd. announced that unauthorized access to a service it operates, between September 14 and 16, 2026, may have leaked names, addresses, phone numbers, email addresses, dates of birth and occupations, along with the type and number of identity documents, the bank name, branch, account number and account holder entered when applying for a buyback (when customers sell items to the shop), images of buyback consent forms, and buyback and order details. The company says no credit card information or passwords leaked and that it does not collect My Number (Japan's individual number). In an addendum on October 9, it added that images of identity documents, including driver's licences, did not leak. The notice also gained a section saying the people affected are those who received an individual email from the company. As of October 10, 2026, the count and the cause have not been announced. This site's take: an account number and holder name alone cannot be used to withdraw money, but do not respond to contacts that use your account details, ID number or real buyback details to look genuine. Never give anyone a PIN, login or authentication code, and if your ID document number leaked, consider a self-declaration with Japan's credit bureaus.
AssuranceAmerica Data Breach (About 7 Million): What to Do When Your Driver's License Number Leaks
On July 10, 2026, US auto insurer AssuranceAmerica notified people that, following malicious activity targeting one of its employees on March 16, an unauthorized third party accessed part of its IT environment and copied certain data files. The Indiana Attorney General's breach list puts the total affected at 6,998,886. Depending on the person, the data included name, contact information, auto policy or account information, driver or vehicle information, claims information and driver's license number, and for a limited number of people a Tax ID or Social Security number. In the US a driver's license number is used as an identity field on credit, insurance and public-benefit applications. A credit freeze alone leaves gaps, so also tell your state motor vehicle agency that your number was exposed.
Carnival Data Breach: What Travellers Should Do When a Passport Number Leaks
Carnival Corporation, the parent of Carnival Cruise Line, says that on April 14, 2026 its IT security team identified unauthorized activity involving an employee's account: an unauthorized actor used social engineering to deceive an employee and gained access to a limited portion of its IT system. On April 22 the company determined that personal information had been copied. Its filing with the Maine Attorney General lists 5,995,277 people affected. The data varies by person and includes name, address, email address, phone number, date of birth and government-issued ID numbers such as driver's license and passport numbers. What leaked is a passport number, not the passport. The official lost-or-stolen process in the US (and in Japan) cancels the document itself and is meant for passports that are actually lost or stolen. The real risk is messages from people who seem to know your trip and your ID. US residents should freeze their credit. Everyone should ignore links in emails posing as the cruise line, and know when a passport really does need to be reported.
Endesa Data Breach (ID and Bank Account Numbers): Handling Scam Calls That Know Your Contract
Endesa Energía told customers (around January 12, 2026) that a malicious actor gained unauthorized access to its commercial platform and may have exfiltrated basic identification data, contact details, national ID (DNI) numbers, energy contract data and, in some cases, IBANs; passwords were not affected. Endesa reported the incident to the Spanish Data Protection Agency (AEPD) and has not published how many customers were affected. This is exactly the kind of data that makes the long-running energy phone scam ('tariff change', 'supply cut-off') believable: a caller who already knows your DNI and your contract doesn't sound like a scammer. Knowing your details proves nothing, so hang up and call the official number yourself. And because an IBAN can be used for direct debits, check your statements: a debit you never authorized can be refunded for up to 13 months.
ANTS (France Titres) Data Breach (2026): Affected Accounts and Response
France Titres, the French national agency for secure documents (ANTS), detected on April 15, 2026 a security incident that may have exposed data from individual and professional accounts on its ants.gouv.fr portal. On April 21 the Interior Ministry said about 11.7 million accounts may be affected. In its answer published May 13, the government said data had been extracted from 11.67 million individual and professional accounts. The data includes login ID, title, surname and first names, email address, date of birth and a unique account ID, and for some accounts a postal address, place of birth and phone number. According to the government, attachments submitted with applications and biometric data are not included. The government asked users to change their password at their next login and to be very careful with suspicious texts, calls and emails that appear to come from ANTS. ANTS put its application pages into maintenance from April 24 and says two-step authentication has been in place since April 29. What leaked is not the ID documents themselves but the fact that a person has dealt with ID, licence or registration paperwork, which is exactly what a convincing ANTS or 'permis de conduire' scam needs. There is no need to replace your documents; the habit that works is never using a link in a message and opening ants.gouv.fr yourself.
Four Government Data Breaches of 2026 (US DoD, Illinois, Latvia, French Tax Authority): What Citizens Can Do
In 2026, government agencies in the US, Latvia and France lost control of citizens' personal data. Lining up the agencies' own accounts, there were three ways in: a wrong sharing setting (Illinois DHS's internal maps), a vulnerable system (the DoD's DMDC file-sharing system, a CSDD web application), and impersonated credentials of staff and an authorized third party (France's DGFiP). When the data holder is the state, 'stop using the service' isn't an option. A citizen's defense shifts to four things that work after a leak: verify notices through official channels, protect the logins to your tax and benefit accounts, call back on a number you look up yourself, and use your right of access to learn what was held and what leaked.
Cariteco (Meitetsu Kyosho) Ransomware Attack: Possible Driver's Licence Data Leak and What Members Should Do
On July 2, 2026, Meitetsu Kyosho Co., Ltd. disclosed unauthorized access to its servers and a system outage detected on June 23, saying an investigation found traces of unauthorized access by ransomware. On August 4 it said it could not rule out a leak of the information members wrote on their application forms for its car-sharing service Cariteco — name, address, date of birth, phone number, email address, driver's license information and, for some members, credit card data — covering both current and former members. No count has been disclosed, and the company says no leak or misuse has been confirmed. This site's take: license data cannot be changed, so, as in the Times Car case, register a fraud alert with Japan's three credit bureaus and check your credit file. Two points are specific to this case: with ransomware, a possible leak can come to light only after the service has been restored; and some of the company's individual notices were undeliverable. Former members who have moved should contact the company rather than wait for a letter.
Odido Data Breach (About 6.39 Million): What to Do When Your ID Number Leaks
On February 12, 2026, Dutch telecom operator Odido disclosed that customer data had been taken from a customer contact system it uses. Its spokesperson put the scale at about 6.2 million accounts; Odido's later FAQ says about 6.39 million people were affected (current and former customers of Odido and its brand Ben). Depending on the person, the data included name, address, mobile number, customer number, email, IBAN, date of birth, and ID document number and expiry; passwords, call records and ID scans were not included. This site's take: an ID number on its own cannot be used to sign contracts or complete procedures; it mainly identifies who you are. The Dutch Central Identity Fraud Reporting Centre (CMI) says this data alone cannot be used to take out a loan, open a bank account, sign a phone contract or apply for a new ID document, and neither replacing passports nor changing account numbers is recommended. The real danger is contact from someone who quotes your leaked numbers to seem genuine. And the broader lesson: ID numbers that businesses collect to verify identity can leak from those same businesses.
Quest Apartment Hotels Data Breach (About 1.99 Million): What Guests Should Do After Card and Passport Numbers Leaked
Australian serviced-apartment chain Quest Apartment Hotels identified unauthorised access to a database system on August 17, 2026, arising from a vulnerability through a third-party service provider, and disclosed it on August 19. Its September 16 update says information on approximately 1,991,613 customers (records from before June 2025) was affected, including 46,727 credit card numbers with CVV and 297,739 without CVV (both including expired cards), 104,268 passport and/or driver licence numbers, 225,300 vehicle registration numbers, 271 NDIS numbers and 46 Medicare card numbers. This site's take: if you were told a card with its CVV was affected, ask your card issuer about a replacement. The card industry standard PCI DSS does not allow card verification codes to be kept after authorization. Quest has not said why CVVs were in these records, and we make no judgment about compliance, but guests should know that a hotel's records can end up holding them.
Data breaches and cyberattacks of 2026: a timeline (Japan and worldwide) — 203 incidents rated by impact, and what they show
This site built a timeline of 203 major data breaches and cyberattacks disclosed from January to October 2026 (99 in Japan, 103 elsewhere, 1 without a country classification), sourced to victim organizations' notices, regulator filings and attributed reporting. Impact is rated in three levels by scale and data type, with the criteria printed on the page. Our take: outside Japan, leaks of identity data — driver's licences, passports, Social Security and other government ID numbers — stand out in 29 of 103 incidents; in Japan, ransomware and vulnerabilities in internet-facing devices and systems (VPN appliances, websites, analytics tools and the like) stand out. Identity data is not as easy to replace as a password, so users should hand it to fewer services and file credit-bureau alerts when it leaks; operators should start with patching internet-facing devices and deciding how long to keep the ID documents they collect.
Shun Hing Group Data Breach in Hong Kong (About 920,000): Handling Scams Posing as Repair or Warranty Calls
Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) received a data breach notification from Shun Hing Group on 23 March 2026 and has opened an investigation. On 2 July 2026, citing the latest information provided by the organisation, the PCPD said the personal data of more than 921,000 people may have been leaked, including about 920,000 customers' names/titles, addresses, phone numbers and email addresses, and about 1,000 staff and service/product/supplier personnel whose data also included identity document numbers, bank account numbers and salaries. About 1,050,000 people's data may have been maliciously encrypted. In its 9 July 2026 notice, Shun Hing Group said there was no evidence of misuse at that time and that its PanaClub system was suspended. This site's take: the potentially involved information includes after-sales contact details, such as an address or phone number given for appliance delivery, installation or warranty registration. A caller who knows your address and what you bought does not prove they are genuine. Don't follow a message's password-reset link; open the official website yourself to check the latest PanaClub guidance.
Standard Bank Data Breach (South Africa): Handling Scam Calls That Know Your ID and Account Numbers
On 23 March 2026, The Standard Bank of South Africa said it had identified unauthorised access to select data. By its 14 April update, the bank said the affected information includes names, ID numbers or company registration numbers, contact details (phone numbers, physical and/or email addresses) and account numbers, later adding B-BBEE categorisation and VAT registration numbers, and that the data 'now appears to have been published'. The bank says its transactional banking and core operating systems were not accessed and client funds are not affected. It has not published how many clients were affected. This site's take: the danger is not someone logging in with this data. It is someone calling you as 'Standard Bank' while reading out your real ID and account number. A caller knowing those numbers doesn't prove it is the bank, and the bank says it will never ask for your passwords, PINs or OTPs. Hang up, call the number on your card, register with SAFPS, and check your credit report.
Texas Parks and Wildlife Data Breach (2026): Affected Users and Response
The Texas Parks and Wildlife Department (TPWD) says that on May 13, 2026 Texas Cyber Command detected a cybersecurity incident involving the TPWD license system vendor that handles the sale of hunting and fishing licenses. According to TPWD, an unauthorized actor may have obtained driver license information, passport numbers (if provided), email addresses, phone numbers and residential addresses for more than 3 million customers; TPWD says Social Security numbers, dates of birth and financial information were not obtained. The Texas Attorney General's breach list shows 3,087,721 Texans affected. This site's take: the licence comes from a state agency, but the ID numbers buyers gave were stored in the systems of TPWD's vendor, a company buyers didn't choose themselves. And because licences are renewed every year, a message from TPWD looks normal, which makes it easy for scammers to imitate. Freeze your credit (a free block that makes it harder to open new accounts in your name), learn the Texas DPS route for a misused licence number, and only renew or pay through a TPWD address you type yourself.
Times Car data breach (6,628,007 records with names and addresses, traces of about 1.46M ID-document images being sent out): checking My Page and what members and former members should do
In its fifth notice on October 23, 2026, Times Mobility Co., Ltd. said the outside forensic investigation had ended and published final counts. In the Times Car web system, traces of attacker access and external transmission were found for 6,628,007 records of name, address, date of birth, phone number, email address and driver's license information. Of the identity-document images, which were stored encrypted, 1,464,800 showed traces of being sent out (the company had earlier said about 1.6 million might have leaked) and 891,602 were accessed with no trace of being sent out. Hashed passwords were sent out in 4 cases. In the related Times Club web system, where unauthorized access was also found, 19,510 Times Club card numbers, 135,436 linked-service IDs and 28 credit card last-four-digit records, among others, showed traces of being sent out (the company does not hold full card numbers or security codes). The cause was the exploitation of a vulnerability in the web system. The company will give a payment worth 3,000 yen to people whose images were sent out (details and method still being decided), and since 17:00 on October 23 has shown each person's leaked items on My Page. This site's take: first check your own items on My Page. If your document images were sent out, register fraud alerts with the credit bureaus and check your credit file; everyone should ignore contacts posing as the company. Former members can inquire through a dedicated form.