A 139 TB claim against a national identity register, and issuance halted. A biometric register has no reissue path.
You can discover who your competitors bank with more readily than who runs their servers.
No credential stolen, no server compromised, no employee deceived. The contract executed exactly as published — the specification and the intent diverged.