IDMerit: 1B KYC Records in Unsecured MongoDB

On 11 November 2025, cybersecurity researchers discovered an unsecured MongoDB database linked to IDMerit—a global digital identity verification company whose KYC/AML services are integrated into onboarding and compliance systems worldwide. The repository contained over 3 billion total records (including system logs and metadata), with roughly 1 billion containing highly sensitive PII—approximately 1 TB of identity verification data. The database had no password protection or encryption and was left accessible on the open internet. It was secured the day after disclosure.

What was exposed

According to the IDMerit 2026 breach record and public reporting, the exposed fields included:

• Identity data: Full names, dates of birth, national ID numbers
• Contact details: Email addresses, phone numbers
• Location data: Physical addresses, postal codes
• Demographic data: Gender
• Telecom metadata: Carrier and device information
• KYC/AML verification logs: Records of identity checks performed for banks, fintechs, and other clients

The combination of national ID numbers, addresses, and phone numbers creates a severe risk for identity theft, SIM swap attacks, and targeted phishing. National IDs are difficult to change and are used for account verification, credit applications, and government services. Telecom metadata can help attackers identify carrier and account details for SIM swap fraud.

Technical root cause: MongoDB misconfiguration

The breach was caused by a misconfigured MongoDB instance—no authentication, no encryption, and no network isolation. MongoDB, when deployed without proper security controls, defaults to binding on all interfaces and allowing unauthenticated access. Common misconfigurations include:

• Leaving bind_ip at 0.0.0.0 without firewall rules
• Failing to enable auth or configure role-based access control
• Exposing development or staging databases to the public internet
• Relying on network obscurity instead of authentication

IDMerit's database was discovered through standard internet scanning; threat actors and researchers routinely scan for exposed MongoDB, Elasticsearch, and Redis instances. The data was not stolen by a targeted attack—it was passively exposed to anyone who found the endpoint.

Geographic distribution

Records were associated with KYC/AML identity verification logs from clients across at least 26 countries. The highest concentrations included:

• United States: 203 million+ records
• Mexico: 124 million
• Philippines: 72 million
• Germany: 61 million
• Italy and France: ~53 million each

This distribution reflects IDMerit's client base—banks, fintechs, gig economy platforms, and other regulated entities that require identity verification for onboarding and compliance.

Third-party and KYC vendor risk

IDMerit operates as a third-party identity verification vendor. When a user opens a bank account, signs up for a fintech app, or completes a gig economy onboarding flow, their identity documents and PII are often sent to vendors like IDMerit for verification. A breach at this layer means:

• No direct breach of banks or fintechs—the exposure occurred at the vendor layer, but the data belongs to end users who interacted with those clients
• Concentrated risk—one vendor compromise affects millions of users across hundreds of client organizations
• Regulatory implications—KYC/AML vendors process highly sensitive data; GDPR, CCPA, and sector-specific rules apply

Organizations that rely on identity verification vendors should assess vendor security posture, data retention policies, and breach notification obligations.

Impact: Identity theft, SIM swap, phishing

The exposed data types enable multiple attack vectors:

• Identity theft: National ID numbers, names, DOB, and addresses can be used to open fraudulent accounts, apply for credit, or bypass KYC checks elsewhere
• SIM swap: Phone numbers plus telecom metadata help attackers target carrier support for SIM porting, enabling account takeover via SMS 2FA
• Targeted phishing: Attackers can craft convincing emails or calls referencing specific identity verification events or financial services
• Synthetic identity fraud: Combined PII supports creation of synthetic identities for financial fraud

Recommendations for affected users

• Monitor financial accounts—Watch for unauthorized transactions, new accounts, or credit applications in your name
• Enable carrier port-out protection—Contact your mobile carrier to add a PIN or additional verification to prevent SIM swap
• Beware of phishing—Expect emails or calls referencing identity verification, bank onboarding, or KYC. Verify any links via official channels
• Consider a credit freeze—Place a freeze on your credit file to prevent unauthorized account openings
• Use unique passwords and MFA—Avoid credential reuse; enable multi-factor authentication on critical accounts

Recommendations for organizations using identity vendors

• Vendor due diligence—Assess identity verification vendors for database security, encryption, access controls, and incident response
• Data minimization—Send only the minimum PII required for verification; avoid retaining full document images longer than necessary
• Contractual obligations—Ensure breach notification, data retention limits, and audit rights are clearly defined

Bottom line

The IDMerit breach underscores the risk of misconfigured cloud databases and the concentrated exposure at third-party identity verification vendors. One billion KYC records left on the open internet represents one of the largest identity-focused breaches on record. For full breach details, timeline, records affected, and technical writeup, see IDMerit 2026 breach on BreachHistory.

Sources: Biometric Update, CyberNews, Tom's Guide