Identity Verification Weekly: US Military Data Breach, AI Bank Fraud, and Digital ID Expansion

A breach at the US Defense Manpower Data Center (DMDC) exposed sensitive personal information belonging to more than 3 million people with military connections.

Unauthorized users had access to a DMDC file-sharing system between October 2025 and July 2026. The affected data included names, dates of birth, Social Security numbers, contact information, and employment-related details. The breach affected approximately 2.76 million living people and another 294,000 deceased individuals.

The incident is particularly significant from an identity perspective. DMDC maintains personnel records across the US Department of Defense ecosystem and supports identity management for military personnel, civilian employees, contractors, retirees, and their families.

Why it matters: Data does not lose its value to fraudsters once a breach is over. Names, dates of birth, Social Security numbers, employment details, and contact information can later be combined to impersonate real people, answer knowledge-based questions, or make fraudulent identities appear more convincing.

The scale of the breach is another reminder that identity verification cannot rely on biographical data simply because it matches an authoritative or independent source. Organizations need to distinguish between information that identifies a person and evidence that the person presenting that information is the legitimate owner.

Fraudsters used AI-assisted impersonation to steal around €95 million from Fideuram, the private banking arm of Intesa Sanpaolo.

The scheme began with a WhatsApp message apparently from Intesa Sanpaolo CEO Carlo Messina asking Fideuram’s then-chairman Paolo Molesini for urgent assistance with a confidential overseas transaction. A subsequent call appeared to come from a senior lawyer, whose voice was reportedly reproduced using AI. The bank’s payments team also received a message apparently from another senior executive.

Together, the interactions created what looked like a consistent corporate approval chain. The bank transferred funds primarily to accounts in China and Hong Kong. More than half has since been recovered, while around €36 million remains missing.

Why it matters: The attack went beyond cloning one voice or impersonating one executive. Fraudsters created several apparently consistent signals that reinforced the same false story.

That makes high-risk decisions harder to protect with isolated checks. Knowing who someone appears to be is different from establishing whether they have the authority to request a particular action and whether that authority has been independently confirmed at the point when the action is taken.

UK regulator Ofcom has opened an investigation into whether Aylo Freesites, the operator of Pornhub, is meeting its age-assurance obligations under the Online Safety Act.

The investigation focuses on an age-assurance process introduced in May 2026. It uses signals from Apple indicating that UK iOS and iPadOS users may have already completed Apple’s age checks.

Ofcom is examining whether Aylo carried out sufficient due diligence and testing before relying on those signals and whether the resulting process is highly effective at determining whether a user is a child. The regulator has stressed that the investigation concerns Aylo’s implementation rather than how Apple itself performs age checks.

Why it matters: Age assurance is increasingly becoming an ecosystem rather than a check performed independently by every service. A platform may receive an age signal, token, or credential generated elsewhere instead of estimating or verifying age itself.

But delegating the check does not necessarily delegate responsibility. Ofcom’s guidance makes clear that regulated services remain responsible for ensuring that the overall age-assurance process is highly effective, including both the original check and the way its result is passed to and used by the service.

That puts greater emphasis on the provenance, integrity, and reliability of reusable age signals.

South Africa has unveiled the first working prototype of its new Digital ID, part of the Department of Home Affairs’ broader effort to move identity and government services onto digital channels.

The smartphone-based credential is linked to the national population register and biometrics. The planned system will allow people to prove their identity digitally and control requests to access their personal information. Its use will be voluntary, and the physical Smart ID card will remain available alongside it.

Why it matters: South Africa joins a growing number of countries introducing digital IDs and identity wallets. As these credentials become more widely available, businesses will need the infrastructure to accept and verify them alongside traditional identity documents.

This changes more than the format of an ID. Verification systems need to establish whether a digital credential comes from a trusted issuer, whether it is authentic and valid, and whether the person presenting it is its legitimate holder. Security will also have to extend beyond the credential itself to the device, biometrics, and oth er mechanisms used to bind it to its owner.

For many organizations, this means preparing for a hybrid identity environment in which physical documents and digital credentials coexist, potentially for years.