You can change a password. What happens when your fingerprint leaks?
In September 2015 the US Office of Personnel Management admitted that the fingerprints of 5.6 million people had been stolen in its breach, five times its first estimate. Its spokesman said federal experts believed the ability to misuse fingerprint data was limited, but that "this probability could change over time as technology evolves". Eleven years on, it has.
The breaches kept coming. In August 2019 researchers found Suprema's BioStar 2 access control platform exposing 27.8 million records and 23 GB of data, including more than a million fingerprint records stored, the researchers said, as actual fingerprints rather than hashes. In 2026 NYC Health + Hospitals reported an intrusion, apparently through a third-party vendor, that affected at least 1.8 million people and may have exposed fingerprint and palm-print data alongside medical and financial records. The Dutch data protection authority said the obvious thing when it fined a company for scanning staff fingerprints: "A fingerprint isn't like a password, it can't be replaced."
What a leaked template can do
A biometric system does not usually store your fingerprint. It stores a template, a compact mathematical description of the features a matcher compares. For years the comforting assumption was that a template could not be turned back into a finger or a face. The research says otherwise. In 2007 a team at the University of Bologna reconstructed fingerprint images from standard minutiae templates and found "a high chance to deceive state-of-the-art commercial fingerprint recognition systems". In 2018 researchers at Hong Kong Baptist University and Michigan State reconstructed faces from deep neural network templates well enough to pass the same system 95% of the time against the enrolled image, and 58% of the time against a different photo of the same person, at a strict false-accept rate. Work published in IEEE Transactions on Information Forensics and Security in 2026 reports success rates of 84% to 93% against face systems that were specifically designed to resist inversion.
The question for anyone deploying biometrics is therefore how to make a leak survivable.
Three properties, one standard
ISO/IEC 24745:2022, the international standard for biometric information protection, requires three properties of a stored reference, among others. Irreversibility: it must be computationally hard to reconstruct the original biometric from it. Unlinkability: two protected templates from the same finger, held by two systems, must not be matchable to each other. Renewability and revocability: a compromised template must be cancellable and replaceable by a fresh one from the same finger, as a password would be.
The techniques that aim at these properties are more than two decades old. Cancellable biometrics apply an intentional, repeatable distortion to the biometric before matching, so that a leaked version can be cancelled and reissued with a different distortion. Biometric cryptosystems such as the fuzzy vault, proposed by Juels and Sudan in 2002, bind a secret key to the biometric so that the stored object reveals neither. Newer work matches templates under fully homomorphic encryption, so the comparison happens without ever decrypting them. The honest caveat, from Nandakumar and Jain, is that these schemes have historically traded accuracy for protection, and that bridging "the chasm between theory and practice" is still work in progress.
Where the template lives matters more
Look again at the breaches above. OPM held fingerprint files centrally. BioStar 2 held, by the researchers' account, raw fingerprints in one database. The hospital breach appears to have come through a vendor's systems. In each case the failure was not a broken protection algorithm but a central store of raw biometric data that someone else could reach.
The alternative is an architecture in which the template never leaves the device that captured it. The FIDO Alliance's design, which underpins passkeys, states that biometric data used for user verification never leaves the user's device and that the server holds a public key and no biometric data. Microsoft's Windows Hello documentation says the same: biometric data "is stored on the local device only" and "is never sent to external devices or servers". Apple's Secure Enclave holds Touch ID and Face ID data in a form only the enclave can read. If a server is breached, there is no template to lose, and if a device is lost, the credential on it can be revoked without touching the finger.
European regulators have reached the same conclusion from the privacy side. In its 2024 opinion on facial recognition at airports, the European Data Protection Board found that a template held only by the passenger could be compatible with the GDPR, while a central database under the airport's or airline's control "cannot be compatible with Article 25". Since February 2025 the EU AI Act has banned several biometric practices outright, including most real-time remote identification by police in public spaces, and its high-risk duties for remote biometric identification, verification excluded, now apply from 2 December 2027.
Four questions to ask
Before any biometric system goes near staff or patients, ask where the template is stored, whether it is raw or protected, whether it can be revoked and reissued, and who holds the key that unlocks it. A system that answers "on the device", "protected", "yes" and "the user" has made a leak survivable. One that answers "in our database" has made it permanent.
