A provider of identity-verification services disclosed possible unauthorised access to identity information, such as scanned documents, stored in customer accounts on its cloud platform. Identity data is among the most sensitive a business can hold, because unlike a password it cannot simply be reset once exposed.
Incidents at verification vendors are especially serious because they concentrate the very documents used to prove who someone is.
What it means: any business that collects customer IDs, for age checks, onboarding or compliance, should hold only what it truly needs and delete it when the need passes. Data you never stored cannot be stolen, so the strongest protection for sensitive documents is to minimise how much you keep and for how long.