In November 2025, an unsecured database linked to IDMerit was reportedly exposed to the open internet for a limited period.
The incident is described not as a sophisticated hack but as a misconfiguration-driven data leak. Publications that surfaced in February 2026 indicate that the exposure may have affected nearly 1 billion unique records across 26 countries.
Country-level breakdowns suggest tens of millions of records may be linked to specific national markets.
What happened?
On November 11, 2025, researchers at Cybernews identified a MongoDB database that lacked password protection and meaningful access controls. Structural and content indicators suggested the database was connected to IDMerit, a provider of digital identity verification services.Initial reports referenced over 3 billion entries. After removing duplicate and overlapping data, the estimated scale focused on approximately 1 billion unique personal records.
According to reporting, IDMerit was notified on November 12, 2025, and the database was taken offline the same day. The case is therefore widely characterized as an operational security lapse — a misconfiguration — rather than an external cyberattack.
Scale and Geography: A 26-Country identity verification pool
What distinguishes this case from a routine data breach is both its geographic spread and the nature of the data involved. Because KYC (Know Your Customer) processes require comprehensive identity validation, the dataset is structurally capable of forming complete identity profiles.Reports indicate that records span 26 countries, with some national datasets reaching into the tens or even hundreds of millions.
This highlights a structural reality: identity verification vendors function as critical infrastructure within the financial ecosystem.
A vulnerability at a single third-party provider can expand the downstream risk surface for banks, fintech firms, crypto platforms, and other regulated entities.
What types of Data were potentially exposed?
KYC systems typically store data required for identity verification and regulatory compliance. Reported fields in the exposed database include:- Full name, residential address, postal code
- Date of birth and gender
- National identification numbers (country-specific ID types)
- Mobile phone numbers and email addresses
- Telecommunications metadata (carrier-related identifiers)
- Limited social profile annotations and “breach status” tags
SIM Swap and account takeover risks
One of the most concerning downstream risks involves SIM swap attacks and SMS-based two-factor authentication (2FA).A SIM swap attack is a form of account takeover fraud that exploits weaknesses in two-factor authentication systems where the second factor is delivered via text message or voice call. By fraudulently transferring a victim’s phone number to a new SIM card, attackers can intercept authentication codes and gain access to financial or digital accounts.
In multiple jurisdictions worldwide, SIM swap-related incidents have led to financial account drainings. While telecom operators and banks have implemented additional safeguards in recent years, such protections are not infallible.
Cross-Border Data governance and third-party risk
The case also raises broader governance questions. When identity verification providers process data across borders, oversight, regulatory compliance, and auditability become complex.Key structural questions include:
- Where is the data stored, and under which jurisdiction?
- Who maintains operational control over identity datasets?
- How rigorously do financial institutions evaluate third-party cybersecurity standards?
Practical security steps for users
When data exposure occurs, one-time action is rarely sufficient. Because leaked datasets may circulate over extended periods, continuous security hygiene is critical.- Use unique, strong passwords for every service. Reused credentials significantly increase risk.
- Enable two-factor authentication — preferably using authenticator apps or hardware keys rather than SMS.
- Contact your mobile carrier to request additional SIM swap protections or account-level PIN safeguards.
- Activate real-time transaction alerts and regularly review financial statements.
- Consider consulting a cybersecurity professional if you suspect exposure.
Identity Verification is infrastructure and infrastructure requires discipline
The IDMerit case underscores a broader structural shift: identity verification is no longer a peripheral compliance function. It is foundational digital infrastructure.Even a seemingly simple configuration error can create multi-country, multi-institutional risk exposure. As digital identity systems scale globally, operational discipline, transparency, and third-party oversight become as critical as encryption and authentication protocols themselves.
Reported by: Onur Metin | HepsiVeri
Bu haber dosyası kamu yararı gözetilerek, resmi istatistikler ve açık veri kaynakları teyit edilerek bağımsız gazetecilik ilkelerine uygun olarak hazırlanmıştır. İçerikte tespit ettiğiniz bir maddi hata, eksiklik ya da tekzip talebi için doğrudan iletisim@hepsiveri.com üzerinden editör masamıza ulaşabilirsiniz.