The FBI Data Hack: Maybe Not an FBI Hack

So everyone’s talking about the FBI data hack, but they’re making assumptions about the FBI itself that may be unfounded.

The story is that ShinyHunters claims to have accessed data from FBIJobs.gov. Obviously whenever you apply for a job, you end up providing a lot of personally identifiable information. And sometimes the information can get REALLY personal.

According to Tech Insider, the FBI has now confirmed the hack occurred.

“According to reporting from PBS NewsHour and NBC News, the bureau said it is ‘aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information.'”

Aha, everyone says. Someone hacked the FBI!

But the FBI also said something else.

“The FBI added that ‘we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk.'”

This raises the possibility that the hackers didn’t get the FBI, but one of the “third-party providers.”

The FBI data hack may have been a hack of a third party. Google Gemini.
The FBI data hack may have been a hack of a third party. Google Gemini.

Kinda like how someone hacked Hertz information, but actually hacked the third-party provider IDScan.net.

Third party risk management (TPRM) is a critical part of your cybersecurity posture. You’d better make sure yours is robust before you’re the victim of a hack.

Are you a TPRM provider who implements solutions for identity, biometric, and technology firms? Or are you a firm who incorporates TPRM into your processes to protect customer data? Then I can help you communicate your solution to convince your customers of the safety of their data. Learn about Bredemarket at https://bredemarket.com/watch-book/.

Watch a 15-Second Pitch, Book a Free 30-Minute Meeting. Revised 10/28/2026.

Why Big Companies Can’t Perform Identity Verification Themselves

When someone asked on LinkedIn why IDScan.net had all that personably identifiable information in the first place, I remembered something about the ability to perform identity verification. Specifically, I remembered one significant sentence from my paradox of identity verification. Emphasis mine.

“To prevent fraud you have to risk fraud by giving selfie plus ID to a firm you don’t know—not Meta or Hertz, but a third party vendor you don’t know.”

Look at simple (?) facial recognition, which Amazon and Google and Meta could perform if they weren’t scared of their own customers. (That fear may have subsided.)

What is identity verification?

But identity verification is much more complex.

  • Yes, it includes facial recognition as well as related disciplines such as presentation attack detection and injection attack detection.
  • But it also includes analysis of a government-issued secure document such as a driver’s license or passport. This analysis checks some of the document’s security features to determine whether it is authentic.
  • Then it naturally compares the live face against the driver’s license face to see if they belong to the same person.
Google Gemini.
  • And in many cases that’s not enough, as identity verification goes beyond who you are and what you have. That includes checking state or provincial motor vehicle records to confirm that the motor vehicle agency knows about this license it supposedly entered.
  • Or it checks credit records, utility records, and the like to confirm that a person is associated with an address, a birthdate, or other personally identifiable information.
  • Or, and as long as they’re at it, the identity verification process ensures you’re not on an anti-money laundering (AML) sanctions list, a list of politically exposed persons (PEP), or a similar blocklist. Hertz may not care, but Bank of America certainly does.

So who can do all of this?

Who can’t perform identity verification

I will tell you who can’t.

Meta can’t do all this, and neither can Amazon or Google.

And Hertz can’t do all this either, and neither can Bank of America or Jerry Rainbow’s Cannabis Shoppe.

Jerry Rainbow can't perform identity verification at his cannibis shop.
Google Gemini.

Why? Because multi-billion dollar companies, and Jerry, don’t understand all the skills needed. Sure Amazon can route goods within warehouses, but it doesn’t know squat about ghost images or microprinting, much less how to check PEP lists.

Who can perform identity verification

So Meta et al outsource their identity verification work to companies that most of you don’t know.

But I do. I worked at Incode for a year and analyzed over 80 of its competitors while I was there.

(Dirty little secret: NONE of these identity verification vendors author ALL their algorithms. Sure they may own intellectual property for certain tasks, but they buy the other tasks from other suppliers.)

But who are you?

Are you a large company trying to understand the identity verification market?

Are you an identity verification company trying to understand your own market?

Do you need confidential help to analyze and plan the impossible?

Google Lyria. Public Domain.

Perhaps Bredemarket’s identity verification and product marketing expertise is what you need.

Talk to me.

Oh, as a postscript: remember when I created three similar videos last Saturday night? I also created a fourth one just for the identity folks.

“The Midnight Line.” Google Lyria. Public Domain.