TuLotero confirms leak of ID cards and verification selfies

TuLotero loses your ID and your verification selfie

Before asking you for a selfie holding your ID, some company should prove it knows how to keep it safe. TuLotero has just given the opposite lesson: the online lottery platform confirmed a few days ago a hack in which national identity documents and users' verification images have been leaked. The company claims that no bank details or passwords were stolen, but it has already filed a complaint with the National Police.

The problem isn't the password, it's the biometrics

A system's security is measured by its weakest link. Passwords can be changed; an ID card cannot, and an image of a face linked to an official document even less so. The verification system known as KYC forces customers to send their ID and a selfie, and it is precisely that biometric material that has been exposed. The leak of this data allows scenarios of identity theft that no password update can resolve.

Can they claim a prize with a leaked ID?

Some readings downplay the alarmism. To claim a significant prize, it is not enough to present a document: the physical ticket and full in-person identification are required. The leak of an ID card does not seem sufficient to empty someone else's prize. Another matter is the rest of digital life: with an official document and a selfie, the margin to attempt impersonating someone in other procedures grows notably.

The question left on the table is how many companies accumulate such sensitive data without the security it demands. Is it really worth handing over your face and your document for a digital lottery ticket?