According to Resecurity, recent data breaches in El Salvador have led to the exposure of up to 80% of its citizens' data on the dark web. Social media reactions suggest that the breach may have originated from the country's digital wallet, Chievo. When El Salvador embraced Blockchain and Bitcoin, it also introduced a digital identity wallet, rewarding citizens with Bitcoin for registration. The culprit behind the breach remains unknown, as the data surfaced on the dark web with untraceable usernames.
The leaked data encompasses individuals' full names, phone numbers, dates of birth, email and physical addresses, national ID details, and even selfie photos. The extensive nature of the leaked information poses significant harm to those affected; the combination of facial images with other personal data provides malicious actors with the means to impersonate, track, or scam individuals.
What lessons can be taken from this incident?
Storing facial image templates alongside other personal data such as names, ages, addresses, and ID numbers is risky. A safer approach involves maintaining separate templates for facial image identification and other personal information.
Countries like Nigeria, that are contemplating centralized databases for identification purposes, should heed the lessons from El Salvador and reconsider their approach. Restructuring their identity system to avoid consolidating all individual details into one template is crucial towards minimising the extent the citizens' data is exposed during data breach.

African countries should ensure that their identity system is well secured because exploits can expose millions of their citizens to dangers of being scammed or impersonated...