Data breaches, identity theft, and revocation: a real-world case study on why W3C is developing Verifiable Credential Barcodes
www.w3.org
In September 2026, journalists reported what may be one of the largest breaches of government-issued identity documents in history. Cybercrime enables document fraud at an unprecedented scale, and cryptographic security on physical documents in the form of digital signatures is not enough. Real-time revocation is needed to protect individuals against identity theft. W3C Verifiable Credential Barcodes could be one solution - and the technology is open and free for all to use.

W3C press release (7 October 2026). Journalists reported a dark web marketplace selling access to digital scans of roughly 160 million driver’s licenses from the US and Canada, apparently sourced from a compromised identity document verification service; the stolen material includes both data elements and images of the documents. The release argues that digital signatures in optical barcodes can simply be copied as images, so signature verification alone does not stop fraudulent use, and presents W3C Verifiable Credential Barcodes together with the Bitstring Status List as an open, royalty-free mechanism for real-time, privacy-preserving revocation of compromised credentials. According to W3C, the California DMV has been issuing licenses and ID cards with such barcodes since late 2025. https://www.w3.org/press-releases/2026/data-breaches-identity-theft-and-revocation-a-real-world-case-study-on-why-w3c-is-developing-verifiable-credential-barcodes/