What we found
myGov App: F$557 million stolen through fake myGov accounts in a single year.
The ATO reported $557 million in identity fraud via myGov in the 2022-23 financial year. Criminals were creating fake myGov accounts, linking them to real tax file numbers, and lodging fraudulent tax returns. The Inspector-General of Taxation called the system "fundamentally flawed".
ADL: FA private advocacy group is training the AI you use every day.
ADL CEO Jonathan Greenblatt publicly stated the ADL is 'working with OpenAI, with Alphabet, with Anthropic, with Meta, with Microsoft' to 'train' their LLMs -- and is 'in conversations with Alibaba to train their LLM.' The ADL is also 'investing in building the technology to train the LLMs more effectively' and 'investing in Wikipedia.' In March 2025, the ADL released an evaluation of GPT, Claude, Gemini, and Llama claiming 'anti-Jewish and anti-Israel bias' -- querying each model 8,600 times. The ADL's stated goal is to make AI models align with its definitions of antisemitism -- definitions that, as of 2024, include anti-Zionist protest chants at political rallies. A private advocacy group -- unelected, unaccountable, criticised by Wikipedia editors as 'generally unreliable' on Israel/Palestine -- is training the AI models that billions of people use to access information. The ADL is not correcting bias. It is inserting its own.
ID.me Identity Verification: FID.me's CEO told Congress they only matched your face to your own photo.
In January 2022, Hall admitted ID.me had been using 1:many facial recognition all along, comparing faces against a database of millions. He called it a "mistake" in communication. Senator Ron Wyden called it "a lie" and demanded an FTC investigation. The reversal came only after investigative reporting forced the admission.
NHS App: F55 million patients' GP records — mental health, sexual health, substance abuse, everything — planned for extraction into a database accessible to pharmaceut...
NHS Digital planned to extract GP records for 55 million patients into a centralised database (GPDPR) accessible to researchers, pharmaceutical companies, and third parties. After public outcry and media coverage, the scheme was delayed repeatedly. Patients had to actively opt out or their entire medical history — including mental health, sexual health, and substance abuse records — would be shared.
Aadhaar / mAadhaar: FThe entire identity of 1.1 billion people, available for $7.
In 2018, The Tribune of India demonstrated that full Aadhaar database access — including names, addresses, phone numbers, and photographs of all 1.1 billion enrolled citizens — could be purchased for 500 rupees ($7) through unauthorized access sold by middlemen. UIDAI filed a police complaint against the journalist. In 2023, Resecurity reported 815 million Indians' Aadhaar and passport data was offered for sale on the dark web.
VA Health / My HealtheVet: F26.5 million veterans — virtually every living person who served in the US military — had their Social Security numbers exposed when a VA employee took a lap...
The VA has experienced repeated data breaches exposing veteran records. In 2006, a laptop stolen from a VA employee's home exposed 26.5 million veterans' records including Social Security numbers. In 2020, the VA disclosed a breach affecting 46,000 veterans' financial information. The GAO has listed VA information security as a "high-risk" area since 2015.
Login.gov: FLogin.gov told 50 federal agencies it met the government's own security standard.
The GSA Inspector General found Login.gov did not actually meet IAL2 standards despite telling agencies it did. The GSA had been billing agencies at IAL2 rates while delivering IAL1 verification — essentially charging for secure identity proofing while providing basic username/password authentication.
IRS2Go App: FCriminals downloaded 700,000 Americans' complete tax returns from the IRS website.
In 2015, the IRS "Get Transcript" breach exposed personal tax data of 700,000 taxpayers. Criminals used stolen personal information to answer authentication questions and download complete tax returns. The IRS initially reported 100,000 affected, then revised upward to 334,000, then again to 700,000 — understating the breach by 7x.