In 2022, administrative credentials associated with AU10TIX were reported to have been exposed online. The reported exposure could have enabled access to personal information submitted for identity verification, including names, dates of birth, nationalities, identification numbers, and the types of identity documents uploaded. Because AU10TIX processes identity data for customers including Airbnb, PayPal, LinkedIn, Fiverr, and X, the incident raised concerns about the concentration of highly sensitive records in a commercial verification system.
The company reportedly did not become aware of the exposed credentials until 2024. In a statement released in 2025, AU10TIX said an internal review found no evidence that data had actually been exposed or that customers were affected. The supplied account does not identify a regulator, court finding, confirmed data theft, or independently established number of affected people, so the incident remains a reported security failure rather than a verified breach. Its lasting significance is the gap between the company’s identity-data responsibilities, the alleged exposure period, and the delayed discovery.