What Happened
A publicly accessible database containing approximately 1 billion records from 26 countries was recently identified by Cybernews investigators. The exposed instance appears to belong to IDMerit, an AI-powered digital identity verification provider serving fintech and financial services companies. This incident was not a typical breach; rather, the data was left open, allowing anyone who knew where to look to access it. Researchers discovered the unsecured database on November 11, 2025, and promptly notified the company, which secured the database shortly thereafter. At this time, there is no evidence that the data was accessed by malicious actors.
Why It Matters
The exposed records included a wide range of personally identifiable information (PII) commonly used for identity verification, such as full names, home addresses, dates of birth, national identification numbers, phone numbers, email addresses, gender information, and potential telecom metadata. Due to the structured and detailed nature of this data, it can be more easily searched and exploited than unstructured datasets. The breakdown of exposed records by country includes approximately 204 million from the United States, 204 million from Mexico, 123 million from the Philippines, 60 million from Germany, and 53 million from Italy.
What’s Next
In light of this incident, organizations are urged to review their data security practices to prevent similar occurrences. The breach highlights the importance of securing sensitive data and the potential risks associated with third-party vendors. As the landscape of cybersecurity continues to evolve, stakeholders must remain vigilant in protecting personal information and ensuring compliance with data protection regulations.
You may also like
