A recent data breach at Revolut resulted in a hacker obtaining sensitive customer information, including passport copies and verification selfies. The attacker is currently leaking the documents of 680 customers online, demanding a ransom of 10,000 Bitcoin.
The incident follows a separate breach involving over 153 million US and Canadian driver’s licenses, which were leaked on a dark web service named Nexus. According to the Privacy Rights Clearinghouse, US data breaches affected at least 343 million people in the first half of 2026.
Current Know Your Customer (KYC) practices often require companies to store large amounts of sensitive data, creating security risks. Experts suggest that zero-knowledge (ZK) proofs could allow identity verification without the need to store physical documents.
While the European Union is beginning to integrate ZK technology into its Digital Identity Wallet to support selective disclosure, adoption remains slow. Challenges include a lack of shared standards, interoperability issues, and regulatory ambiguity regarding data retention.
Although the Financial Action Task Force (FATF) provides a risk-based framework that does not explicitly mandate the permanent storage of raw document images, institutions often retain them to satisfy auditors. Experts argue that clear regulatory amendments are needed to encourage the shift toward ZK-based verification.
