Categories: Data Breach

Biometric Security Platform Data Breach Leaked Millions of Users Facial Recognition & Fingerprinting Data

Security researchers discovered the biggest data breach in Biometric Security Platform BioStar 2 that leaks millions of users facial recognition records, fingerprints, log data, and other personal information.

BioStar 2, a web-based biometric security smart lock platform by world’s biggest bio-access B2B company Suprema, and the platform used by UK Metropolitan police, defense contractors and banks, many local businesses and government networks.

Biostar 2 biometrics lock system deployed as a centralized system that offers user registration, real-time alarm, and door control in office builds and data warehouse.

In order to identify users, it also supporting facial recognition and fingerprinting technology to identify users.

The usage of Biostar 2 usage has been expanded since it was integrated into the AEOS access control system used by over 5,700 organizations in 83 countries.

A report published by security researchers from vpnmentor were able to access over 1 million fingerprint records, as well as facial recognition information.

Leaked data includes the personal information of employees and unencrypted usernames and passwords which is also highly sensitive in nature.

The team from vpnmentor was able to access over 27.8 million records, a total of 23 gigabytes of following data:

1. Access to client admin panels, dashboards, back end controls
2. Fingerprint data
3. Facial recognition information and images of users
4. Unencrypted usernames, passwords, and user IDs
5. Records of entry and exit to secure areas
6. Employee records including start dates
7. Employee security levels and clearances
8. Personal details, including employee home address and emails
9. Businesses’ employee structures and hierarchies
10. Mobile device and OS information

Biostar 2 platform has deployed over 1.5 million worldwide installations, and all of these could be vulnerable to this leak.

Facial recognition and fingerprint information are highly sensitive than any other data and once the data is stolen it cannot be changed, and it affects to rest of their life.

If these sensitive data take over by the cybercriminals, it will mishandle by them and leads to high risk for the organization and government networks, which allows to breach the companies network and take over the accounts.

“Hackers can change the fingerprints of existing accounts to their own and hijack a user account to access restricted areas undetected. Hackers and other criminals could potentially create libraries of fingerprints to be used any time they want to enter somewhere without being detected. “

Even it compromise the companies physical security and allow criminals to perform Robbery and steal valuable information, plant viruses, monitor and exploit systems.

Sponsored:  – Manage all the Endpoint networks from a single Console.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to disrupt…

2 days ago

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code execution…

2 days ago

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile…

2 days ago

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular application…

2 days ago

EU Targets Stark Industries in Cyberattack Sanctions Crackdown

The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…

2 days ago

Venice.ai’s Unrestricted Access Sparks Concerns Over AI-Driven Cyber Threats

Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…

2 days ago