According to this blog post (which I assume is an accurate description of the breach):


a large amount of very sensitive BioStar 2 biometric data has been leaked. I'm not familiar with BioStar 2 but I had been fingerprinted in some situations in the past and I'd like to know if there's a way to know if I'm affected by this or not.

(I don't know if this breach would only affect people who explicitly ordered some device or work in particular places (my work doesn't use fingerprint checks) or if this would affect people going through immigration checks when crossing borders, for example.)

Is there a way to learn if I'm impacted by this breach?

2 Answers 2


From the linked article:

BioStar 2 is a web-based biometric security smart lock platform. A centralized application, it allows admins to control access to secure areas of facilities, manage user permissions, integrate with 3rd party security apps, and record activity logs.

It seems that unless you have access to somewhere that uses biometrics for that (and they used this software), you won't be affected.


I do understand the privacy issued associated with leaked biometric/genetic or other sensitive data, but in some cases it does not pose such a risk. While not exactly an answer to your question, how could your leaked fingerprint be a problem, in and of itself?

As for the actual answer, companies are obligated to inform the victims of data breaches. If someone is still concerned, they also have the legal right to enguire the company as to that. All this, of course, assumes that the company (or any other company) will be forthcoming, which nobody can quarantee

  • Its also a critical security issue. If a password gets breached, you change it. If your fingerprints get breached, you're compromised for life. And yes, its possible to spoof fingerprints to unlock biometric "secured" devices. Its been done in the past and will assuredly be done in the future. Jan 28 at 20:34
  • Of course the fingerprints cannot be changed... So we either shouldn't use biometrics at all, or rely/trust that the defice that does the verification to grant access or release keys is actually well made and tested. I don't think it's reasonable for any security model to expect the user to somehow protect their fingerprints (since they are left literally everywhere we touch). It is up to the device to validate whether it's genuine. I have come across the scanners that just scan an image or the supposedly secure "sonic" reders... maybe past failures teach something to companies making them
    – Minas
    Jan 29 at 2:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.