TL;DR
- 01What happened
On February 18, 2026, security outlet Cybernews reported that about a billion records of personal data apparently used for identity verification (KYC) (about 3 billion records in total, across 26 countries) had been found in a password-less MongoDB database, and that it belonged to IDMerit. The database was found on November 11, 2025 and closed the day after notification. IDMerit denied it, saying it does not own, control or store customer data or the data held by independent data sources, and that there was no exposure in its environment.
- 02Why it was hard to tell
IDMerit did, however, acknowledge that certain ports associated with independent data sources could have been open. Cybernews’s basis for attribution was clues such as collection names and its team’s belief; neither side has published records showing who owned the database.
- 03The missing layer
The database was closed the day after notification, so detection worked. A class action filed in the US also ended in dismissal without a ruling. What failed was the layer that can show, from records, whose custody the data was in and under which contract it was held.
What happened
- Who
- IDMerit, based in California, which connects to 440+ data sources in 180+ countries to provide identity verification by API (per the company).
- Discovery
- An outside researcher working with Cybernews found a password-less MongoDB database on November 11, 2025. It was closed the day after notification, on November 12. Publication came on February 18, 2026.
- Claimed scale (unverified)
- About 3 billion records; about 1 billion broken down by country and said to contain sensitive personal data, with the rest likely logs. About 1TB, 26 countries; about 203 million in the US and 124 million in Mexico, among others.
- Data types (claimed)
- Names, addresses, dates of birth, national ID numbers, phone numbers, email addresses, gender, telecom metadata and more.
- Basis for attribution
- Cybernews wrote that “our team believes the exposed database belongs to IDMerit”, citing clues such as collection names in some countries (“idmtelco”). It did not publish hostnames or similar evidence directly identifying the owner.
- IDMerit’s denial
- It does not own, control or store customer data or data held by independent data sources. Its review found no exposure, vulnerability or unauthorised access in the IDMerit environment. It did acknowledge that certain ports associated with independent data sources could have been open, potentially exposing databases. It said that when it asked for the report it was asked for money, and suspected a ransom motive.
- Cybernews’s note
- The finder was an outside contributor, and Cybernews did not know until February 26 about the exchange between the finder and IDMerit over payment for the findings. Its internal researchers reviewed the technical material and found the findings legitimate.
Glossary
Data source — An outside holder of data, such as a telecom or public records, that an identity-verification company queries. Such companies connect to many sources to return a result.
Custody — Whose control data is under, and who is responsible for protecting it. Breach notification and liability follow from custody.
MongoDB — A widely used database. Depending on its settings, it can be readable from the internet without a password.
The point to stop it was ①. Had it been recorded, when the data was placed, whose custody it was in and under which contract, the dispute at ④ could have been settled from records.
IDMerit, or a data source?
About 3 billion records (claimed).
2025-11-11 → 11-12.
Denial and rebuttal; lawsuit dismissed.
Timeline — disclosure and response
- A researcher finds the password-less database and reports it.
- The database is closed.
- Cybernews publishes. The next day it retitles the piece “IDMerit data breach” and rewrites the database as “owned by IDMerit”.
- Biometric Update publishes IDMerit’s denial.
- Cybernews learns of the payment exchange between the finder and IDMerit (per its note).
- A class action against IDMerit is filed in the US District Court for the Southern District of California.
- The plaintiff voluntarily dismisses the case; no ruling was made.
The figures and contents are Cybernews’s claims and have not been independently verified. IDMerit’s denial is not backed by records that outsiders can check either. As of October 2026, there has been no regulator finding and no disclosure identifying the database’s owner. This Brief does not rule on either side’s claims.
After disclosure
- Cybernews: Maintained that the findings were legitimate, and noted that it does not sell fixes.
- IDMerit: Around the same time published blog posts on its no-storage design, without referring to the case directly.
Why it wasn’t stopped
This case does not come down to one side being wrong. As identity-check data flows across vendors, data sources and the links between them, neither side could show from records whose custody the database that was found was in.
That an open database existed could be confirmed, but neither the side denying it nor the side reporting it could show from records whose custody the data was in.
Proof works when data is placed; detection works after an open database is found. Detection got the database closed, but does not decide whose data it was.
but whose it was stays unsettled
Detection worked: the database was closed the day after notification. But “an open database existed” can be confirmed while “whose custody the data was in” is a separate fact, and without records, neither the side denying it nor the side reporting it could show it. That distance is the detection–proof gap, and it is a structural one.
The same structure appears in Sumsub (client end-users’ contact details left outside the core at an identity-verification vendor).
How to counter this
Be able to show, from records, whose custody identity-check data is in and where it is kept. Identity-verification vendors connect to many data sources, and data flows across organisations. Those who outsource should set out in contracts whether the vendor, and the data sources beyond it, store the data and where, and ask for records. Then, if told your data was found, you can answer from records whether it was yours.
Industries and operations to watch
- IndustryFinance & FinTech
- Financial institutions, payment and crypto businesses that outsource identity checks by API. Users’ data also reaches the data sources beyond the vendor.
- OperationLookup & data access
- Querying outside data sources about users for identity checks. Each query moves data across organisations.
Do today’s controls close it?
| Control | This case | Why |
|---|---|---|
| The vendor’s “we don’t store it” | Partial | It can account for the vendor’s own environment, not the data sources beyond it. |
| Data-processing contracts (storage, location) | Partial | Even when set, without records outsiders can check, a dispute is not settled. |
| Checking databases’ exposure settings | Partial | It finds open databases, but not whose they are. |
| Discovery and reporting by researchers | Partial | The database was closed the next day, but whose it was was never settled. |
- Know the data flow beyond your vendor. Ask the vendor for a list of which data sources it queries and where data is stored, or not.
- Set storage and location in contracts and confirm them with records. If data is not stored, ask for records showing that. If it is, set where and for how long.
- Record whose custody and which contract. For each set of data, keep who controls it and on what basis it was entrusted, in a form that can later be shown to a third party: in other words, as proof. If challenged, you can answer at once whether it was yours.
Three things to confirm in an organisation that outsources identity checks
- Can you name the data sources your vendor queries and where data is stored?
- Do you confirm your vendor’s “we don’t store it” with records, not just the statement?
- If told your users’ data had been found, could you answer from records whether it was in your custody?
Note: records do not settle a dispute if the records themselves can be falsified, so they must be kept in a form that can be checked independently of the parties. Asking for records from data sources beyond the vendor also makes contract negotiations heavier.
Sources
- Primary, finder’s reportCybernews “IDMerit data breach: 1 billion records of personal data exposed in KYC data leak”
- Primary, court docketUS District Court Andrizzi v. IDMerit LLC, No. 3:26-cv-01527 (S.D. Cal., filed 2026-03-11, dismissed 06-03)
- Primary, complaintUS District Court Complaint in Andrizzi v. IDMerit LLC
2 more (reporting, analysis)
- Reporting, carries IDMerit’s statementBiometric Update “IDMerit disputes report of 1B records exposed in unsecured ID verification database”
- Reporting, carries IDMerit’s statementFox News “1 billion identity records exposed in ID verification data leak”
References: “The last layer left for cyber defense in the age of AI”
The facts of this case are disputed between the parties, and this Brief does not rule on either side’s claims.