Data breaches, identity theft, and revocation: a real-world case study on why W3C is developing Verifiable Credential Barcodes
In September 2026, journalists discovered a dark web marketplace selling access to digital scans of approximately 160 million driver’s licenses from the United States and Canada. Initial reporting suggests that the source of the stolen data was a compromised identity document verification service. This is one of the largest compromises of government-issued identity documents in North America — and it includes not just data elements extracted from the documents, but images of the documents, as well.
Identity thieves will use this data to impersonate victims. Images of stolen identity documents can be used to pass online identity checks required to create new accounts or take over existing ones, enabling crimes like large-scale bank fraud. Additionally, attackers could use this massive selection of stolen documents to target victims they sufficiently resemble to pass in-person verification checks. A high-quality, forged physical document that contains data stolen from a genuine document presented by someone who strongly resembles the image on the card — is an extremely difficult attack to detect using traditional means.
The future of physical document security is being decided as we speak. Real-time revocation is needed to protect individuals against identity theft. W3C Verifiable Credential Barcodes are the solution — and the technology is open and free for all to use.
Real-time revocation is a necessity — not a luxury
Modern credentialing efforts such as W3C Verifiable Credentials add cryptographic security to digital credentials in the form of digital signatures. W3C Verifiable Credential Barcodes take this one step further by enabling these credentials to secure physical documents such as driver’s licenses.
W3C Verifiable Credentials Data Model v2.0 became a global web standard in May 2025. Verifiable Credential Barcodes add to the Verifiable Credentials ecosystem by connecting its digital credential technologies to physical credential use cases. The Verifiable Credentials ecosystem is dynamic, and its suite of specifications and features grows and adapts to developments in cryptography and computing.
We have described two attacks above: a digital attack, where an attacker uses stolen document images to pass online checks, and an in-person attack, where an attacker extracts all data from a genuine document to manufacture a forged physical document. A digital signature alone does not prevent either attack. Because digital signatures in optical barcodes are simply images, they can be easily copied. A stolen, high-resolution image of a barcode containing a valid digital signature will pass signature verification checks just like the original. Defending against these attacks requires a real-time revocation mechanism — a switch that an issuing organization can flip when a document has been compromised, that invalidates it instantly and causes all future verification attempts to fail.
W3C Bitstring Status List, which has already reached the status of global web standard, serves as such a status mechanism, granting credential issuers fine-grained, real-time, and per-credential control. Crucially, this process preserves privacy by eliminating invasive “phone home” calls to the issuing authority during verification, preventing the issuer from learning when or where a specific credential is being used. Version 1.0 of the Bitstring Status List was published as a W3C Recommendation in 2025, and Version 1.1 is currently under development. Because the technology was designed hand in hand with W3C Verifiable Credentials and Verifiable Credential Barcodes, it is perfectly suited for use cases requiring immediate, real-time revocation.
As cyber attacks grow in frequency and scope, security technologies for physical credentials must harden. Privacy-preserving and real-time revocation mechanisms are not perks — they are necessities.
Securing physical credentials with free, open-source W3C Verifiable Credential Barcodes
If the more than 160 million stolen documents had been protected with W3C Verifiable Credential Barcodes, addressing the threats described here would be as simple as identifying which documents were included in the breach. When an attacker attempts to use a revoked credential, the status-check step of the verification process fails. This instantly stops both the digital attack (fraudulently presenting a stolen image over the web) and the in-person attack (presenting a forged physical document containing stolen data and a copied digital signature) right in their tracks.
The W3C Verifiable Credential Barcodes technology is open, public, royalty-free, and fully available to the global community. Any credential-issuing organization looking to protect its users against identity fraud can implement the specification and its related tools. Currently a W3C Recommendation-track document, this specification has undergone rigorous threat modeling to ensure its design decisions adhere to the highest expectations of privacy and security. It sits alongside W3C’s Verifiable Credential Forgery Defense technology that hardens verifiable credentials against quantum attacks and key compromise. All of this work inherits the strengths of the mature W3C Verifiable Credentials ecosystem, including the Bitstring Status List mechanism.
Finally, the technology is already production-tested: since late 2025, the California Department of Motor Vehicles has been issuing new driver's licenses and identification cards with a W3C Verifiable Credential Barcode.
The Verifiable Credential Barcodes technology we are building in the W3C Verifiable Credentials Working Group is already protecting millions of people from identity theft and fraud, with the potential to protect billions more. We want to make sure that government organizations and policymakers know that there is a free and open solution to this problem that is being designed for the public good. If you would like to join us in the work of developing digital identity standards, please become a W3C Member, or contact the W3C Membership Team for information on joining.
Front and back of a driver's license issued by the fictional state of Utopia. The barcode on the back of the license contains a cryptographically secured W3C Verifiable Credential.
About the World Wide Web Consortium (W3C)
The mission of the World Wide Web Consortium (W3C) is to make the web work — for everyone. W3C offers a unique platform for creating and maintaining a broad range of technical standards and guidelines that enable a World Wide Web which connects and empowers humanity.
W3C convenes hundreds of member organizations, thousands of dedicated technologists and the broad global community, who together shape the future of web technologies, advancing the benefits that accessibility, internationalization, security, and privacy bring to the web and everyone who uses it.
W3C standards enable people and businesses on the web to address society’s social, cultural and economic needs by ensuring an open, accessible, and interoperable web. Some examples are WCAG, SVG, WebRTC, and HTML and CSS, two of the foundational technologies upon which websites are built.
W3C’s work is created in the open and provided for free under the groundbreaking W3C Patent Policy that ensures web standards can be implemented and used widely without complex licensing or costly royalties, which in turn helps to foster open development, and supports the web's growth as a common global infrastructure for all.
W3C is a public-interest, non-profit organization incorporated in the United States of America, led by a Board of Directors and employing a global staff. W3C is funded through Member dues as well as donations, sponsorships, and grants. Supporting us makes a huge difference to our operations and helps W3C to achieve its vision. For more information, see https://www.w3.org/.
End Press Release
Media Contact
Amy van der Hiel, W3C Media Relations Manager and Brand Coordinator, w3t-pr@w3.org
+1.617.453.8943 (US, Eastern Time)
