Identity in Ecuador after the leaks

Every remote identity check in Ecuador — opening an account, activating a line, paying out a bet, closing a sale — now runs against an adversary who already holds the data it asks for. This white paper sets out what leaked, why photo-based verification stopped proving anything, what the ICAO 9303 chip proves instead, and what the data-protection law makes of it.

• Ecuadorians' identity data is already public. The 2019 Novaestrat leak exposed roughly twenty million records, including seventeen million Ecuadorians and 6.7 million children [1]. In May 2026, 14.8 million identity records and more than ten million high-resolution ID images appeared on dark forums, with signatures and fingerprint data [2].
• Asking for that data therefore verifies nobody. An ID number, a photo of the document and a selfie are three things an attacker can obtain or fabricate. Identity fraud in Ecuador rose 26% year over year [5], and the Attorney General recorded 4,784 identity-impersonation complaints between January and October 2025 [4].
• The attacker improves faster than the defence watching them. Video-injection attacks against face verification on iOS grew 1,151% in the second half of 2025, and native virtual-camera attacks 2,665% [6]. Looking harder at an image loses ground with every generation of models.
• One proof does not degrade. The chip in Ecuador's chip cédula and in ICAO e-passports carries the issuing state's signature. Validating it — Passive Authentication — is not a judgement of an image, and forging it takes the state's private key, not a better generative model. Matching the live face to the portrait inside that signed chip proves the person is the document's holder.

The law settles the rest. Since May 2023 the LOPDP fines minor infringements 0.1%–0.7% and serious ones 0.7%–1% of the prior year's turnover [8], which turns a stored archive of ID scans into a standing liability. The best way to handle sensitive data is not to hold it: receive facts, not files.