Welcome to ID Tech’s digest of identity industry news. Here’s what you need to know about the world of digital identity and biometrics today:
IBM Acquires AuthMind to Watch How AI Agents Use Their Credentials
IBM has acquired identity security company AuthMind for an undisclosed sum to extend continuous visibility and governance over how human, machine, and AI agent identities use their access credentials once they leave HashiCorp Vault. Building on an earlier 2023 seed investment by IBM Ventures, the integration incorporates AuthMind’s identity activity graph to detect shadow agents operating outside established governance frameworks, map resource access paths, flag anomalous behavior or excessive permissions across network traffic, and enforce least-privilege controls with real-time revocation across IBM’s security and automation platforms.
Fittings Maker MACO Takes Majority Stake in Fingerprint Access Firm ekey
Austrian window and door fittings manufacturer MACO Group is acquiring a majority stake in Linz-based biometric access provider ekey biometric systems to develop integrated smart building access solutions for global residential and commercial markets. While financial terms remain undisclosed, the transaction brings ekey’s 80 employees and fingerprint access product lines under the MACO Group umbrella while preserving the ekey brand and existing industry partnerships, with MACO chief sales officer Manuel Biechl and founding family representative Michael Gallner-Holzmann assuming joint leadership as managing directors.
Hackers Took 72,702 Passport Photos From Taiwan’s Consular Websites
Taiwan’s Bureau of Consular Affairs disclosed that hackers breached its web infrastructure in early November, exfiltrating 72,702 passport photo files alongside 26,072 scanned powers of attorney and data from 774 APEC Business Travel Card applications. Part of the Ministry of Foreign Affairs, the bureau isolated the compromised servers and restored operations after security testing, noting that while names, dates of birth, and national identification numbers from passport renewal systems were not taken, authorities will seek compensation from negligent contractors and refer the breach for criminal investigation under the Personal Data Protection Act.
Judge Certifies Amazon Photos BIPA Class, Rejects Non-User Class
U.S. District Judge John J. Tharp Jr. has certified a class-action lawsuit representing Illinois residents whose faces were scanned in their own accounts under Amazon Photos facial recognition features without prior written consent required by the state’s Biometric Information Privacy Act. Ruling in Hogan v. Amazon.com, Inc., the Northern District of Illinois court covered 339,847 Illinois-billed accounts active between October 2016 and January 2023, while rejecting a separate proposed class of non-users appearing in background photos as an unidentifiable group ahead of a December 1 status hearing.
UK Police Inspectorate Calls for Tighter Oversight of Retrospective Face Searches
His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services has issued 16 recommendations urging police forces in England and Wales and the National Crime Agency to implement stronger governance and national standards for retrospective facial recognition. Following a Home Secretary-commissioned review of roughly 291,341 annual searches conducted on the Police National Database, inspectors highlighted inconsistent local policies, the retention of expired custody images, and over-reliance on uncorroborated algorithmic matches, calling for mandatory data protection impact assessments and centralized search access controls by 2027.
Veridas Opens Epic Integration for MyChart Sign-Up and Clinician Access
Biometric vendor Veridas has launched a turnkey integration with Epic software that enables healthcare systems to deploy document and selfie verification for MyChart patient accounts and EpicCare Link clinician portals. Available ahead of its listing in the Epic Connection Hub marketplace, the iBeta-certified and CEN/TS 18099-compliant identity engine aims to curb medical identity theft and duplicate patient records during remote account creation and recovery while helping hospitals meet federal TEFCA data portability requirements without custom IT development.
Helix Raises $6.2 Million for On-Device Voice Checks That Spot Bots and Estimate Age
Los Angeles-based startup Helix has raised $6.2 million in pre-seed funding led by Chicago Ventures to commercialize an on-device voice verification and age estimation SDK designed to detect bots and verify human presence in under four seconds. Processing a four-number spoken challenge locally on smartphones without transmitting biometric data to external servers, the ISO/IEC 27566-1 and IEEE-certified platform offers non-document age assurance compliant with New York’s SAFE for Kids Act and is currently in beta evaluation with in-home wellness platform Zeel.
Belgium’s Anti-Fraud Plan Adds Face Matching Against the eID Photo to itsme
Belgium’s federal government has unveiled a 29-point national anti-fraud action plan that introduces biometric face matching against national identity card photos during select activations of the itsme digital identity app. Presented by Consumer Protection Minister Rob Beenders and Interior Minister Bernard Quintin, the comprehensive strategy also establishes an inter-bank suspicious account intelligence platform, expands the Phish Nemo fraudulent website warning system nationwide, introduces SIM-swap protections, and guarantees assisted branch counter banking for up to 5 euros per month.
Vietnam’s Revised Draft Drops Face Scans for Stock Orders but Keeps Them for Bank Account Changes
Vietnam’s Ministry of Finance has revised its draft circular on electronic securities trading to remove mandatory biometric checks for routine online stock orders while retaining mandatory facial verification for high-risk bank account modifications. Following industry feedback from brokerage firms warning of login bottlenecks across more than 12 million active accounts, the State Securities Commission dropped biometric requirements for cross-device orders and transfers over 10 million dong, keeping a 12-month implementation timeline while leaving VNeID integration mechanics to be resolved by competent authorities.
–
By the ID Tech Editorial Team