2026 MongoDB Atlas exposure — 444k Australian borrowers

Sydney-based fintech youX confirmed a major data breach on February 19, 2026. An unsecured MongoDB Atlas cluster was accessed by threat actors, exposing 141GB of sensitive data that had been left accessible for at least 10 months. Data includes 229,236 driver's licences, 607,822 residential addresses, loan applications ($3.7B across ~150k records from 93 lenders), and data from 797 broker organizations. Related incident: Vroom by YouX had an exposed S3 database (March 2025) with ~27k records.