We decided not to release this tool’s source code. Not because there is anything complicated in it. Quite the opposite, and that is the whole point. Anyone with access to today’s language models can put it together in a few hours, on their own, from publicly available pieces. We built it in a single evening. The risk this article is about is real, and it is large.

We are writing about it not to hand anyone a manual. Quite the opposite, to make clear that no manual is needed any more, because any model will assemble one in an afternoon. When a barrier is so low that a weekend project steps over it, it stops being a barrier.

This text follows on from The State as the Biggest Threat to Your Privacy. There we described what happened. Here we show what it means in practice: what it costs, how fast it goes, and what can be done about it.

What happened

On 17 August 2026 the new business register began officially publishing the collection of deeds in such a way that anyone in the world can download the birth number, the full permanent residence address, the ID card number and the verified handwritten signature of every director and shareholder of a Slovak company. Not through a leak. Not through a bug in the code. The state published it, by law, through the regular legislative process.

No login. No electronic ID. No proof of legitimate interest. Free of charge. And without any record of who downloaded what.

The only obstacle to mass downloading is a four-character image code. A CAPTCHA.

And why is a leaked birth number worse than a leaked password? Because in Slovakia the birth number is used at once in two incompatible roles. As an identifier (something like a username, which others may perfectly well know) and as an authenticator (something like a password, by which you prove it is you). It is as if a bank handed you one string and said: this is both your login and your password, and you will never change it.

The tool

To see what that obstacle really means in 2026, we built ourselves an application in one evening. We call it the ORSR aggregator. You enter a company name or company ID. With a single click, and in a few seconds, the app returns, for any owner or director:

• the date of birth
• the birth number
• the permanent residence address
• the ID card number (if the filing contains it)
• the signature specimen, cut straight out of the scanned filing, as a JPG

And one more thing we expected less. With a single click you find out which health insurer a given person is registered with, via their birth number, on the public ÚDZS verifier. That one is protected by a “stronger” Google reCAPTCHA. The app solves it automatically, just like the image one. The only difference between you and a script is the price of one token, and that price is in cents.

How it works is simple: the public register data is joined together, the filings from the collection are downloaded through the CAPTCHA, the text is read (scans too, via OCR), the birth number and address are matched to the right person by date of birth, and the signature is cut out of the page image. None of this is research. It is an evening spent gluing ready-made parts together.

We will admit it: what unsettled us most was how boring it was. No breakthrough, no brilliant flaw in the system. A few hours of work for an AI agent.

A CAPTCHA does not stop bots. It stops you

This has to be said out loud, because it is the heart of the mistake the register’s whole “protection” rests on.

Recognising four characters in an image is a task at which machines surpassed humans years ago. There is a whole market of services, commercial gateways that will solve the code for you through an API for a fraction of a cent. Our tool uses four at once:

• DeathByCaptcha
• 2Captcha
• CapMonster
• NoCaptchaAI

It sends the same image to all four at once and takes the answer from whichever replies fastest and correctly. The fast gateways return a solution within two seconds. The register does not “consume” a CAPTCHA on a failed attempt, so you can try several answers on one image, and it is enough for one of them to land.

The upshot: the CAPTCHA on the business register slows down a single participant, the human. You, when you want to look at three filings and have to decipher blurred letters three times. To a script that wants to download five hundred thousand of them, it is no obstacle at all. It is a lock that holds the door shut against the owner of the flat and open to the thief with a skeleton key that opens it for a tenth of a cent.

The address and date of birth are free, even without a CAPTCHA

Before we get to the price of birth numbers, there is an uncomfortable thing to say. Part of that package does not cost even the tenth of a cent.

The Register of Legal Entities, run by the Statistical Office of the Slovak Republic, has an official public REST API under the open Creative Commons (CC-BY) licence. It returns, in machine format, the name, the date of establishment and the address of every director and shareholder, including the permanent residence address of natural persons. No CAPTCHA, no limit, no login. Entities have numeric identifiers, so the whole register can be walked sequentially or in batches through date filters.

That means: you get the permanent residence address and the identity base of every Slovak entrepreneur today for free and at machine speed. The CAPTCHA now protects only the birth number and the signature, that is, what sits in the scanned filings. Nothing more.

What it costs to download the whole register

Let us put a number on it. In Slovakia there are roughly half a million companies with a collection of deeds, and in them hundreds of thousands of directors and shareholders. To obtain the birth number and the signature specimen of every person, an attacker needs to download a few filings per company: the founding document and the signature specimens. Let us count approximately 1.5 million downloads, each for one successfully solved CAPTCHA.

The figures that follow are order-of-magnitude estimates, not a set of accounts. The number of companies, the number of filings per company and the success rate of the gateways can each be disputed by tens of percent. It changes nothing about the conclusion: whether it comes out at eight hundred dollars or at four thousand, we are still talking about the price of a used laptop for the identity of every entrepreneur in the country.

We measured the gateway prices on real CAPTCHAs from the register. The key figure is not the price per thousand attempts but the price per thousand successful downloads, that is, the price divided by the gateway’s success rate:

To be clear about the sums: the last two columns are not the price for one person. It is the price for downloading the data of all entrepreneurs and directors in Slovakia at once, the whole register. The “birth numbers only” column covers everyone’s birth numbers, and the “full package” column adds each person’s signature specimen on top.

If you care about speed and send the image to all four at once, you pay all of them but you land almost always on the first attempt, and the whole register comes out at about $4,000. If you care about price and use a single reliable cheap gateway, you get under $1,300. Birth numbers alone, without signatures, are a matter of a few hundred dollars.

On top of that, optionally, the insurer of every person via ÚDZS. That is a different type of CAPTCHA (reCAPTCHA), more expensive, but still cheap: for a million people from ~$600 through the cheapest gateway.

In euros it is practically the same number. In short: the birth number, signature and health insurer of every Slovak company owner can be bought today for the price of a used laptop. The address and date of birth come with it for free.

How fast

Price is not the only axis. The second is time, and that depends on how many machines you put on it.

The register limits the number of requests from one IP address. So from a single computer the download would take days. But an attacker does not sit behind one computer. In the cloud, for a few hundred dollars, they rent thousands of rotating IP addresses and spread the work out:

• 100 IPs: the whole register in about two days
• 1,000 IPs: about five hours
• 5,000 IPs: under an hour

The CAPTCHA-solving gateways handle thousands of concurrent tasks, so they are not the bottleneck. The only bottleneck is the number of IP addresses, and those are bought today as a commodity. Put differently: a complete copy of the sensitive data of every Slovak entrepreneur can be made by one averagely skilled person in a single afternoon.

Where the birth number is used across Slovakia

Let us come back to that dual role of identifier and authenticator. Everywhere the birth number carries weight:

• Health insurance: the birth number is the insured person’s identifier. Through the public verifier you can (as our tool shows) also find out where you are insured.
• Social Insurance Agency: pensions, benefits, contributions, your whole working-life history hangs on the birth number.
• Banks and especially non-bank lenders: for phone and online identity checks they still routinely ask for the birth number and address as proof that it is you. Non-bank lenders are notorious for it. And if you believe that voice identification will protect you on a call to the bank, look at what voice synthesis by ElevenLabs AI can do today: a convincing clone of your voice needs a few seconds of a recording.
• Telecom operators: contracts, SIM registration, verification on the customer line.
• Tax administration: the tax identification number of a natural person is derived directly from the birth number.
• Land registry: ownership relationships to real estate are kept under the birth number.
• e-Health, doctors, pharmacies: the electronic prescription and medical records are tied to the birth number.
• Employers and payroll, insurers, notaries, courts, schools, public offices.

Notice the pattern. In most of these places the birth number serves as proof of identity in remote verification: on the phone, at the counter, in a form. Exactly where an attacker who now knows it will use it against you. A password everyone knows is not a password.

The insurer: one data point multiplied by a million

Once more to that insurer verification, because it is more interesting than it looks at first glance. For a single person, which health insurer they are with is just one more fragment of the profile. But the same tool that verifies one verifies a million too. And then a harmless data point turns into something else.

The verifier is a public oracle. For a given birth number, ÚDZS confirms whether it belongs to a real, insured person, and which of the three insurers they are with. This is not only about entrepreneurs. The birth number has a predictable structure (date of birth, a serial, a check digit), so it can be generated and verified. The automatically solved reCAPTCHA turns into a machine that confirms the validity of birth numbers at scale and adds the insurer to them, far beyond the circle of company directors, potentially for a large part of the population. How far it really goes depends on how aggressively ÚDZS rate-limits requests, but the principle does not change. A data point meant to let a person verify themselves turns into a tool for verifying others.

An intelligence database that not even the insurers have. When you attach age, address, share value and insurer to the birth numbers from the register, you get a map that officially no one has: how many clients each insurer has in the entrepreneur segment, their age, income and regional structure, and how it shifts over time when you repeat the measurement. That is sensitive competitive information which is otherwise paid for dearly or cannot be obtained at all.

Targeted poaching of the “right” clients. With such a map, an insurer or broker can precisely target the profitable segment of the competition (young, healthy, well-earning) and leave the rest be. That is the exact opposite of what solidarity-based insurance rests on, where risk is spread. The same logic works in reverse: you can estimate who is “expensive” for the system.

A health data point through the back door. That someone changed insurer, or is not with one, reveals nothing on its own. Combined with the date, the address and other scraps, it lets you infer life events and health status. Exactly the kind of information that has no business being in the hands of an employer, a creditor, or anyone who decides about you.

For one person, a detail. For the whole population, a register of the insured that no one ever approved.

How it can be abused

These are not hypotheticals. They are direct consequences of what is now public.

Forgery. A verified signature specimen together with the birth number and the ID document number is exactly the package you need for a convincing forged filing. Minutes of a general meeting, a share transfer agreement, a power of attorney. In all of them the authenticity of the signature is compared against precisely the specimen that is now public. The signature specimen once existed so a notary could verify authenticity. Published to the whole world, it gives far more ways to forge a signature than to verify one. In the extreme we are talking about taking over a company through a forged transfer of a share.

A call you will not see through. A caller who knows your birth number, ID card number, address and the exact structure of your company is indistinguishable from you on the line of a bank or an operator. Add a voice deepfake, which today needs thirty seconds of a recording, and you have an attack that not even a careful victim will detect. This includes SIM swapping, which then bypasses the SMS verification to your bank account.

A target list. The register holds the permanent residence address together with the value of the business share. That is a list of people ranked by wealth, with their home address. For anyone holding crypto it is literally a target list for a physical attack. For a journalist, a judge, a lawyer or an activist with their own company it is a ready-made tool for intimidation. And you can go further. You convert the address from the register, through a public map (OpenStreetMap or the state address register), into precise coordinates, and send those to the land registry, which for the parcel returns the owner, their share and co-owners. That whole chain is public and free: from a name you get a home address, and from it a map of real-estate assets.

And it is not theory. In France the number of brutal assaults and kidnappings of people connected with crypto rose sharply in 2026 after data on hundreds of thousands of taxpayers, including their addresses and incomes, leaked from the tax administration. In one of the cases, moreover, an employee of the tax office directly searched for cryptocurrency holders and sold their addresses to criminal groups, who then attacked in their homes, in front of their families. This is exactly the type of attack that a public list of addresses ranked by wealth opens up. A detailed account: rekt.news/total-exposure.

And we will add three that follow from the fact that all of this runs automatically and in bulk:

Linking with other leaks. The birth number is a unique key. Whoever has it can join your record from the register with leaked KYC documents from crypto exchanges, with databases from other leaks, with your accounts. Scattered shards turn into one profile.

Targeted phishing at industrial scale. A message that knows your real birth number and address gets past your distrust differently than generic spam. It can now be tailored for hundreds of thousands of people at once.

Resale as a service. Nothing stops someone from doing the whole harvest once and then offering it as a searchable database: you enter a name, you get the package. For the thousand dollars it cost, it pays for itself many times over.

And the most important thing: you change a password, you block a card, you replace your ID. Your birth number you have for life. Even if the state switched off the portal tomorrow and amended the law, whatever was downloaded in the meantime stays in circulation forever. This is an irreversible leak. It cannot be taken back, it can only be documented.

And no one will find out who it was

One last question remains: who would get caught for it? No one.

All four anti-captcha gateways can be ordered completely anonymously and paid for in cryptocurrency, with no name, no card, no invoice. In the same way you can anonymously pay in crypto for the cloud and the rotating IP addresses the harvester runs on. On top of that the register keeps, as we mentioned, no record of who downloaded what. It does not even know that anything is happening.

Put it together. The entry investment is the price of a used laptop, paid in a way no one will link to a specific person. The infrastructure is anonymous. The target logs no access. The result is an attack that leaves no perpetrator behind, but leaves a copy of the identity of every entrepreneur in the country that will circulate forever. The combination of cheap, fast and untraceable is exactly what makes this a problem we have no answer to.

What to do about it

For an entrepreneur there is only one reasonable reaction: treat your birth number as public. Tell your bank, your operator and your insurer that the birth number and address are no longer proof of identity, and demand stronger verification. And watch whether a filing you did not sign appears against your company.

The state will solve this in only one way: redact the birth numbers and signature specimens from the collection of deeds, tie access to sensitive documents to the electronic ID and to a record of who downloaded what. It is not technically demanding, other countries do it as a matter of course. A CAPTCHA for a tenth of a cent is not protection. It is an alibi.

Unlike the state, in this article we deliberately show no real birth number or signature of any specific person.