Generally, such stories relate either to digital identity products rather than age assurance, or to legacy systems never designed to meet the standards required in the age verification sector.
In one widely quoted example, users may have had government ID photos exposed through a breach at a third-party customer service database. Images had been uploaded in connection with age related appeals and were sitting indefinitely in the general helpdesk system. The reported breach concerned the appeal workflow the website had instituted, not the core privacy preserving age assurance transaction (nor the appeals process offered by the age assurance provider itself, which would not have retained thousands of ID documents, so they could not have been stolen).
The incident shows why data retention, support workflows and vendor oversight matter. It does not show that age assurance is inherently unsafe. It shows why the safest systems minimise what is collected, separate the age check from the platform, avoid unnecessary retention and are independently audited, and why appeal evidence needs the same discipline as the check itself: reviewed quickly, then deleted, not left in a general-purpose helpdesk ticketing tool. Certified age assurance is the answer to incidents like this, not their cause, and the incident is a strong argument for regulators to require the high international standards we endorse.