Breach Year
2019
Breach Type
Physical Security / Biometric Vendor
TPRM Lesson
Biometric vendors hold data that cannot be rotated.
What was the Suprema BioStar 2 Biometric Exposure breach?
The Suprema BioStar 2 exposure was an August 2019 incident in which researchers at vpnMentor discovered a publicly accessible Elasticsearch database belonging to the biometric access-control platform BioStar 2, exposing 27.8 million records including fingerprint templates, facial recognition data, unencrypted passwords and personal details of employees at thousands of organisations globally.
Suprema is the case that showed biometric vendors hold data that cannot be rotated.
You can change a password. You cannot change your fingerprints or your face.
When 27.8 million biometric records leaked from a single access-control vendor, the harm was permanent by definition.
BioStar 2 is a biometric access-control platform from South Korean vendor Suprema, integrated into building security systems used by banks, police forces, defence contractors and enterprises.
Early Aug 2019. Researchers Noam Rotem and Ran Locar of vpnMentor discovered a public Elasticsearch database.
Contents. 27.8 million records including 1 million fingerprint records, facial recognition data, plaintext passwords, and employee personal data.
13 Aug 2019. Public disclosure after vendor remediation.
The incident led to guidance from data protection authorities requiring hashed template storage and cloud posture management for biometric systems.
The physical building doors were fine. It was the vendor database that failed. Physical security failed digitally.
A. Identity and Access. No public database exposure.
B. SaaS and API Integrations. Restrict biometric API scope.
C. Software Supply Chain. Assess biometric vendor code.
D. File Transfer and Data Exchange. Encrypt templates in transit.
E. Data Protection. Store hashed templates only.
F. Vendor Incident Response. Biometric-specific notification.
G. Fourth-Party Risk. Assess biometric hosting providers.
H. Board and Executive Reporting. Biometric risk quarterly.
"You can rotate a password. You cannot rotate a fingerprint."
A 2019 discovery of a public Elasticsearch database of biometric access-control data.
27.8 million, including fingerprints and facial templates.
vpnMentor researchers Noam Rotem and Ran Locar.
Downstream organisations' employee biometrics were held by the vendor.
Fingerprint and facial templates, plaintext passwords, personal details.
Authentication, hashed templates and cloud posture management.
Biometric data cannot be rotated so it must be minimally stored and strongly protected.
Regulators opened reviews but no headline fine was imposed publicly.
All claims in this case study are grounded in verified public reporting.
TPRM Blog
Continue learning with the latest breach alerts, regulatory updates, and analyst playbooks from blog.learntprm.com.
Founding SponsorAlmost every case here was findable before it happened
Read enough third-party breaches and the pattern is brutal: an undisclosed fourth party, an expired certification, an exposure that sat on the internet for weeks. Nobody was lazy - the signals simply arrive faster than a human review cycle. The SAFE TPRM AI Co-Worker watches for them continuously.
This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.
Five correlated data dimensions per vendor, refreshed continuously across the whole portfolio.
For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.
25+
AI agents
90%
Less manual effort
None
Additional headcount
200+
Organizations globally
End to end
Intake to offboarding
Most people talk about risk management. Few can prove their expertise under pressure.
Start Your Free Certification