Citizen headache, in numbers
452,879,405
email-address records exposed in verified data breaches during the last 12 months
Data citizens never chose to hand over, leaked by the companies and government agencies they have to trust.
University of Nottingham·455K records·2026/
BCD Travel·396K records·2026/
CTT·468K records·2026/
Odido·6.1M records·2026/
Pass'Sport·6.4M records·2025/
APOIA.se·451K records·2025/
University of Nottingham·455K records·2026/
BCD Travel·396K records·2026/
CTT·468K records·2026/
Odido·6.1M records·2026/
Pass'Sport·6.4M records·2025/
APOIA.se·451K records·2025/
Source: Have I Been Pwned · rolling 12 months by breach date · excludes spam lists, malware and stealer-log datasets · counts breach records, not unique people
Headache:
Citizens have to hand over personal data to every service they use, and have no control over what happens to it afterwards. Breaches are the symptom.
Training and simulation:
Prototyping a new concept for a blockchain-based identity management and application platform, based on the Self-sovereign Identity paradigm.
Technology and testnets:
Solidity contracts, React, JavaScript, TypeScript, Ethereum Sepolia, Avalanche Fuji, Axelar GMP. (Moonbase Alpha was used until it was retired in July 2026.)
Status:
idappt decitizen is an experimental demonstrator under technical testing. Five Groth16 zero-knowledge circuits and their backend verification path are implemented and merged, using synthetic test data and test-only setup material. After Moonbase Alpha was retired, the government-side contract moved to Avalanche Fuji. The citizen-side contract was redeployed on Ethereum Sepolia. Both contracts are deployed and source-verified, and the cross-chain pipeline between them works again and has been tested in both directions. A first on-chain issuer trust registry is also live on Sepolia: proofs are only accepted if they’re signed by a registered issuer key. For now, the registered issuers are test entries. Proofs are still generated on the server rather than on the citizen’s device. Freshness checks, credential revocation and further security and reliability work remain.