Massive global KYC data leak exposes billions of personal records

A recent investigation by Cybernews has uncovered a massive global data leak that exposed nearly a terabyte of sensitive personal information from individuals in 26 countries.

The exposed information includes full names, addresses, national identification documents, phone numbers, and other personally identifiable information (PII), highlighting the vulnerabilities in the digital identity verification ecosystem.

The leaked database is believed to belong to IDMerit, an AI-powered digital identity verification provider serving the fintech and financial services sectors.

IDMerit helps companies verify user identities in real time, ensuring compliance with Know Your Customer (KYC) regulations—an essential element of the modern digital economy.

Discovery and Immediate Response

The Cybernews team discovered the exposed MongoDB instance on November 11th and immediately contacted IDMerit.

The company promptly secured the database, and there is no evidence that malicious actors had accessed or misused the information.

However, researchers warned that automated crawlers frequently scan the internet for exposed databases, potentially enabling instant theft of sensitive data.

Scope and Content of the Leak

The leaked database reportedly contained nearly one terabyte of data across several databases. The dataset included information for individuals from multiple countries, with the following types of data exposed:

• Full names

• Addresses and postcodes

• Dates of birth

• National identification numbers

• Phone numbers and telecom metadata

• Genders

• Email addresses

• Breach status and social profile annotations

The last category—Breach status and social profile annotations—may indicate whether the data originated from prior breaches or leaks, although the exact meaning remains unclear.

Cybernews noted that the level of exposed personal information varied by country. Analysts warn that such data could be used for account takeovers, targeted phishing, credit fraud, SIM swaps, and other long-tail privacy harms, underlining the risk posed by centralised third-party identity verification services.

Global Reach and Volume

The leak is remarkable both in scale and geography. The dataset reportedly included 3 billion records, though many entries likely overlap across databases. Of these, roughly 1 billion records contain sensitive personal information, while the remaining 2 billion are likely system logs or less sensitive data.

The countries with the highest number of exposed records include:

1. United States – 203 million records

2. Mexico – 124 million records

3. Philippines – 72 million records

4. Germany – 61 million records

5. Italy – 53 million records

6. France – 53 million records

Cybernews researchers noted that multiple regions include high-risk identifiers such as national IDs, full dates of birth, and contact data, which are prime targets for identity theft, SIM-swapping, and social engineering attacks.

Industry Implications

The incident underscores the critical role that third-party identity verification providers now play in the digital economy. “At this scale, downstream risks include account takeovers, targeted phishing, credit fraud, SIM swaps, and long-tail privacy harms,” the Cybernews team said. “Industry-wide, the case underlines how third-party identity vendors have become critical infrastructure and can become single points of catastrophic failure.”

While IDMerit has secured the exposed database, the leak serves as a stark warning about the vulnerabilities inherent in centralized KYC systems and the potential consequences of insufficient data security.

Conclusion

As digital identity verification continues to expand across financial services and beyond, this leak highlights the importance of robust cybersecurity protocols and vigilant monitoring. Individuals whose information may have been included in the breach are advised to monitor accounts closely, remain alert for phishing attempts, and consider protective measures such as identity monitoring services.

Cybernews has reached out to IDMerit for comment and will update its findings as more information becomes available.