Categories: Data Breach

Biometric Security Platform Data Breach Leaked Millions of Users Facial Recognition & Fingerprinting Data

Security researchers discovered the biggest data breach in Biometric Security Platform BioStar 2 that leaks millions of users facial recognition records, fingerprints, log data, and other personal information.

BioStar 2, a web-based biometric security smart lock platform by world’s biggest bio-access B2B company Suprema, and the platform used by UK Metropolitan police, defense contractors and banks, many local businesses and government networks.

Biostar 2 biometrics lock system deployed as a centralized system that offers user registration, real-time alarm, and door control in office builds and data warehouse.

In order to identify users, it also supporting facial recognition and fingerprinting technology to identify users.

The usage of Biostar 2 usage has been expanded since it was integrated into the AEOS access control system used by over 5,700 organizations in 83 countries.

A report published by security researchers from vpnmentor were able to access over 1 million fingerprint records, as well as facial recognition information.

Leaked data includes the personal information of employees and unencrypted usernames and passwords which is also highly sensitive in nature.

The team from vpnmentor was able to access over 27.8 million records, a total of 23 gigabytes of following data:

1. Access to client admin panels, dashboards, back end controls
2. Fingerprint data
3. Facial recognition information and images of users
4. Unencrypted usernames, passwords, and user IDs
5. Records of entry and exit to secure areas
6. Employee records including start dates
7. Employee security levels and clearances
8. Personal details, including employee home address and emails
9. Businesses’ employee structures and hierarchies
10. Mobile device and OS information

Biostar 2 platform has deployed over 1.5 million worldwide installations, and all of these could be vulnerable to this leak.

Facial recognition and fingerprint information are highly sensitive than any other data and once the data is stolen it cannot be changed, and it affects to rest of their life.

If these sensitive data take over by the cybercriminals, it will mishandle by them and leads to high risk for the organization and government networks, which allows to breach the companies network and take over the accounts.

“Hackers can change the fingerprints of existing accounts to their own and hijack a user account to access restricted areas undetected. Hackers and other criminals could potentially create libraries of fingerprints to be used any time they want to enter somewhere without being detected. “

Even it compromise the companies physical security and allow criminals to perform Robbery and steal valuable information, plant viruses, monitor and exploit systems.

Sponsored:  – Manage all the Endpoint networks from a single Console.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Cisco IOS, XE, and XR Vulnerability Allows Remote Device Reboots

 Cisco has issued an urgent security advisory (cisco-sa-twamp-kV4FHugn) warning of a critical vulnerability in its…

2 hours ago

OpenCTI: Free Cyber Threat Intelligence Platform for Security Experts

OpenCTI (Open Cyber Threat Intelligence) stands out as a free, open source platform specifically designed…

3 hours ago

LockBit Ransomware Group Breached: Internal Chats and Data Leaked Online

The notorious LockBit ransomware group, once considered one of the world’s most prolific cyber extortion…

5 hours ago

Cisco IOS XE Wireless Controllers Vulnerability Lets Attackers Seize Full Control

A critical security flaw has been discovered in Cisco IOS XE Wireless LAN Controllers (WLCs),…

6 hours ago

Top Ransomware Groups Target Financial Sector, 406 Incidents Revealed

Flashpoint analysts have reported that between April 2024 and April 2025, the financial sector emerged…

20 hours ago

Agenda Ransomware Group Enhances Tactics with SmokeLoader and NETXLOADER

The Agenda ransomware group, also known as Qilin, has been reported to intensify its attacks…

20 hours ago