1 billion identity records exposed in ID verification data leak

Things similar your name, location address, day of commencement and adjacent your Social Security fig whitethorn person been sitting connected the unfastened internet. Researchers accidental an unprotected database tied to IDMerit, a institution that claims to assistance businesses verify identities, exposed astir 1 cardinal delicate records crossed 26 countries.

In the United States alone, much than 203 cardinal records were near unsecured. This involves the nonstop documents and details companies usage to corroborate you are truly you. If criminals get that benignant of information, they'd person everything they need.

Sign up for my FREE CyberGuy Report
Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox. Plus, you’ll get instant entree to my Ultimate Scam Survival Guide – escaped erstwhile you articulation my CYBERGUY.COM newsletter.

BE AWARE OF EXTORTION SCAM EMAILS CLAIMING YOUR DATA IS STOLEN

Researchers accidental an exposed database tied to IDMerit near astir 1 cardinal delicate individuality records disposable connected the unfastened internet. (Morteza Nikoubazl/NurPhoto via Getty Images)

What you request to cognize astir the monolithic information leak

Researchers astatine Cybernews, a cybersecurity quality and probe publication, discovered an exposed MongoDB database connected Nov. 11, 2025, that they judge belongs to IDMerit, a planetary individuality verification supplier that serves banks, fintech firms and different fiscal services companies. IDMerit uses artificial quality tools to assistance businesses execute KYC, abbreviated for Know Your Customer, which is the individuality verification process required erstwhile you unfastened fiscal accounts.

The database was not protected by a password. Anyone who knew wherever to look could entree it. Inside were afloat names, location addresses, postal codes, dates of birth, nationalist ID numbers, telephone numbers, email addresses and sex information. Some records besides included telecom-related metadata and interior flags that whitethorn person referenced past breaches.

The vulnerability affected radical successful 26 countries. The United States had the highest fig of exposed records astatine much than 203 million. Mexico, the Philippines, Germany, Italy and France were besides heavy impacted.

Researchers notified the company, and the database was secured the pursuing day. There is presently nary nationalist grounds that criminals downloaded the data. Still, it's worthy noting that automated bots perpetually scan the net for exposed databases and tin transcript them wrong minutes.

YOU COULD BE SHARING YOUR SOCIAL SECURITY NUMBER WHEN YOU DON'T NEED TO

The unsecured database reportedly contained highly delicate details including names, location addresses, dates of commencement and nationalist ID numbers. (Silas Stein/picture confederation via Getty Images)

How it happened and wherefore it matters for you

When you unfastened a slope account, motion up for a crypto level oregon verify your individuality for a fiscal app, you are often asked to upload a authorities ID and supply idiosyncratic details. Companies similar IDMerit process that accusation down the scenes. That means this database apt contained the aforesaid details you would usage to beryllium your individuality to a slope oregon authorities agency.

For criminals, that is gold. With your afloat name, day of birth, nationalist ID and telephone number, scammers tin effort SIM-swap attacks. This is erstwhile idiosyncratic convinces your mobile bearer to transportation your telephone fig to their device. Once they power your number, they tin intercept information codes sent by substance connection and interruption into your slope oregon email accounts. They tin besides motorboat highly targeted phishing scams. Imagine receiving a telephone oregon email that includes your existent location code and ID number. It would consciousness legitimate, and that's precisely the point.

Because the information was neatly organized, criminals could benignant it by state oregon different details and usage automated tools to people immense numbers of radical with scams.

We reached retired to IDMerit for comment, but did not perceive backmost earlier our deadline.

FIGURE DATA BREACH EXPOSES NEARLY 1M ACCOUNTS

Experts pass that information similar this tin assistance criminals motorboat SIM swap attacks and highly targeted phishing scams. (Kurt "CyberGuy" Knutsson)

8 ways you tin support yourself from information leaks

Before criminals person a accidental to usage this accusation against you, present are applicable steps you tin instrumentality close present to fastener things down and trim your risk.

1) Freeze your recognition reports

Contact the large recognition bureaus successful your state and spot a recognition freeze. This prevents criminals from opening loans oregon recognition cards successful your name. Even if idiosyncratic has your nationalist ID and day of birth, lenders volition not beryllium capable to entree your recognition record without your permission.

2) Stop relying connected substance connection information codes

If your slope oregon email relationship inactive uses SMS codes for two-factor authentication, power to an authenticator app instead. Text messages tin beryllium intercepted during SIM-swap attacks. An authenticator app generates codes straight connected your device, making it overmuch harder for criminals to interruption in.

3) Use a password manager

If attackers brace leaked individuality information with passwords from older breaches, they tin effort to entree your accounts. A password manager creates strong, unsocial passwords for each account, truthful 1 leak does not unlock everything else.

Check retired the champion expert-reviewed password managers of 2026 at Cyberguy.com.

4) Consider individuality theft protection

Identity theft monitoring services tin alert you if your idiosyncratic accusation is utilized to unfastened accounts oregon appears connected acheronian web marketplaces. Early detection tin mean the quality betwixt stopping fraud rapidly and discovering it months later. See my tips and champion picks connected Best Identity Theft Protection astatine Cyberguy.com

5) Watch your mobile relationship closely

Log successful to your mobile bearer relationship and alteration other information features, specified arsenic a port-out PIN if available. This adds an further furniture of extortion truthful idiosyncratic cannot easy determination your telephone fig to different SIM card.

6) Run antivirus bundle connected your devices

Good antivirus bundle tin artifact malicious links, fake login pages and spyware that whitethorn beryllium utilized successful follow-up attacks. After a ample information exposure, phishing campaigns often spike, and having extortion successful spot tin halt you from clicking into trouble. Get my picks for the champion 2026 antivirus extortion winners for your Windows, Mac, Android and iOS devices astatine Cyberguy.com.

7) Consider a idiosyncratic information removal service

Your idiosyncratic accusation is often scattered crossed information broker sites and people-search databases that merchantability entree to your details. A idiosyncratic information removal work tin show wherever your accusation appears online and enactment to get it taken down. This reduces the magnitude of information criminals tin find astir you successful 1 place, making it harder for them to portion unneurotic your individuality and people you with scams oregon fraud. Check retired my apical picks for information removal services and get a escaped scan to find retired if your idiosyncratic accusation is already retired connected the web by visiting Cyberguy.com.

8) Be skeptical of calls that cognize excessively much

If idiosyncratic contacts you and references your address, day of commencement oregon ID number, bash not presume they are legitimate. Hang up and telephone the authoritative fig listed connected the company's website. Criminals usage existent information to marque fake stories dependable convincing.

Kurt's cardinal takeaway

This incidental exposes a larger problem. Companies that grip individuality verification person go captious infrastructure for the integer economy. When 1 of them leaves a database open, the fallout spreads crossed countries and millions of mean radical who ne'er adjacent heard of the company. You trusted a slope oregon app with your ID. That slope trusted a 3rd party. Somewhere successful that chain, basal information controls failed.

Should companies that grip individuality verification look automatic penalties erstwhile they exposure millions of people's astir delicate data? Let america cognize by penning to america astatine Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox. Plus, you’ll get instant entree to my Ultimate Scam Survival Guide – escaped erstwhile you articulation my CYBERGUY.COM newsletter. 

Copyright 2026 CyberGuy.com. All rights reserved.