One billion identities, one open port, and a SIM-swap kit ready to ship

One billion identities, one open port, and a SIM-swap kit ready to ship

A misconfigured MongoDB instance left roughly three billion records, of which about one billion contained sensitive personally identifiable information, sitting on the open internet without a password for an undetermined window before researchers at Cybernews found it on November 11, 2025. The leak, traced to California identity verification provider IDMerit, did not merely expose names and birth dates; it bundled them with telco metadata and phone numbers, which is the precise ingredient list industrial SIM-swap crews need to drain custodial exchange accounts at scale.

What was exposed

The data taxonomy reads like a worst-case shopping list for an identity fraud operator. Inside the 1 terabyte-plus instance, Cybernews documented full names paired with residential addresses and postal codes, dates of birth, national identity numbers, telephone numbers, gender markers, email addresses, telco metadata describing the mobile network associated with each subscriber, and KYC/AML verification logs showing when and how a given identity had been validated against which counterparty. Each field on its own is recoverable, sometimes even cheap on legacy breach markets. The combination is not. A national ID number plus a current residential address plus the mobile carrier plus the matching phone number plus a timestamped KYC pass is, functionally, a notarized identity packet, the sort of bundle a fraud worker would otherwise have to assemble across four or five separate sources.

The geographic reach was disclosed across at least 26 countries, with the heaviest concentrations as follows:

• United States: 203 million records
• Mexico: 124 million records
• Philippines: 72 million records
• Germany: 61 million records
• Italy: 53 million records
• France: 53 million records

The KYC/AML logs deserve a separate note. These are not raw identity documents alone; they are the audit trail of identity verification, which means an attacker reading them knows which fintech or exchange already trusts a given identity, when that trust was issued, and against what document. That converts a fraud attempt from cold outreach to warm impersonation, with the supporting paperwork pre-validated.

The 99-day gap

Cybernews discovered the open instance on November 11, 2025, notified IDMerit the same day or shortly after, and the database was secured on November 12, the day following discovery. Public disclosure came on February 18, 2026, ninety-nine days after the initial find, a delay Cybernews characterized as standard responsible-disclosure practice for a dataset of this sensitivity.

The IDMerit response, however, did not match the documentation. The company stated that the "review found no exposure, vulnerability or unauthorized access within the IDMERIT environment" and that "IDMERIT's systems and security infrastructure have never been compromised," adding that it had "no indication that any customer data has been compromised" and floating the possibility that the incident was "ransom-related." The language is careful, and it is also at odds with the empirical fact of a one-terabyte dataset, branded with IDMerit's verification logs, served unauthenticated from a MongoDB endpoint that researchers reached by accident. The company's narrower phrasing about "data ports associated with independent data sources" being potentially open is the seam where the denial holds, technically, while the harm to the individuals named in the database does not become any less real for the distinction.

The SIM-swap pipeline

The SIM-swap angle is what elevates this leak from embarrassing to weaponizable. Cybernews wrote in its disclosure that the exposed telco metadata, including mobile network information, "could facilitate SIM-swap attacks," noting separately that telco metadata combined with phone numbers "increase the risk of criminals taking over victims' phone numbers to intercept authentication codes."

The mechanics are well documented; the 2024 federal conviction in the $8 million SIM-swap cryptocurrency theft case, covered in depth by KrebsOnSecurity, laid out the standard pipeline. An operator targets a high-value account, identifies the victim's carrier, walks into a retail store or social-engineers a call center with sufficient identity proofs to pass the carrier's authentication checks, ports the number to a SIM under the operator's control, intercepts the inbound SMS one-time-password from the exchange, and resets the account. Every step of that pipeline has a friction point, and the friction is identity verification at the carrier. The IDMerit dataset removes that friction. With the national ID, address, date of birth, and current carrier ready to be pasted into a script, the work that previously occupied a small criminal cell over weeks per victim collapses into an assembly line.

This is the part the headline number obscures. One billion sensitive records is not one billion bad outcomes; it is the labor input for several years of industrial SIM-swap, distributed across whichever buyers acquire shards of the database as it inevitably circulates.

Why KYC providers are the new attack surface

The IDMerit leak is not isolated. Sumsub, whose client roster includes Bitget, Bitpanda, Bybit, Huobi, and Wirex, suffered its own breach earlier in 2026, and the broader pattern of alleged exchange-admin leaks (the Kraken admin disclosure being the most-discussed recent example) suggests that the centralization of identity collection has created a class of targets richer than the exchanges themselves. An exchange, hacked, loses its hot wallet; a KYC vendor, hacked, loses the verified identities of every exchange's user base at once, which then enables the next round of account takeovers across dozens of unrelated venues.

The structural problem is that regulatory pressure has pushed identity verification toward a small number of specialized providers, on the reasonable theory that specialization improves quality, and that consolidation has produced exactly the concentrated single-point-of-failure that any security engineer would warn against if it were proposed deliberately. The compliance regime mandates the collection; market dynamics concentrate the storage; and the storage, as IDMerit has now demonstrated, can sit on an open port for an unknown number of days before anyone notices.

What this changes for the Directory: our verdict

We are downgrading our treatment of any listed exchange that relies on a KYC provider with a documented 2025 or 2026 breach until that provider publishes a credible post-mortem, not a denial. IDMerit's statement does not qualify. Sumsub's breach is fresh enough that we treat any platform routing identity flows through it (Bybit, Bitget, Huobi, among others) as carrying elevated SIM-swap risk for users who still rely on SMS-based 2FA, which on those venues remains the default for many account types.

Our concrete recommendation: if a reader has historically passed KYC at any major exchange using a U.S., Mexican, Philippine, German, Italian, or French phone number, assume the carrier metadata is in circulation, replace SMS-based 2FA with a hardware token or, where supported, an authenticator app bound to the device, and consider rotating the phone number associated with the exchange account where the operational cost of doing so is bearable. For new sign-ups, the no-KYC alternatives we already cover are not a privacy preference any longer; they are a SIM-swap mitigation.

The leak's most uncomfortable lesson is not that IDMerit failed. It is that the regulated, audited, compliant path now routinely produces datasets the criminal market could not have assembled on its own.

Sources

• Global data leak exposes billion records (Cybernews)
• IDMerit data breach analysis (Bright Defense)
• 1 Billion KYC Records Exposed in Massive Identity Data Leak (Quantrail Data)
• IDMerit KYC Data: One Billion Records Exposed (FinCrime Central)
• IDMerit data leak (Zyphe)
• kycisbad reference repository (GitHub)

Edit log

• 2026-03-08 : Pulled the original Cybernews disclosure, scraped the country-level counts into a sortable table and cross-checked the totals against the Bright Defense write-up.
• 2026-03-24 : Read IDMerit's denial twice and compared the wording, "no exposure within the IDMERIT environment," against the Cybernews methodology for attributing the bucket.
• 2026-04-09 : Mapped the Sumsub client list (Bitget, Bitpanda, Bybit, Huobi, Wirex) against the IDMerit downstream fintech list to find overlap; left out three names where the relationship is press-release only.
• 2026-04-18 : Drafted the SIM-swap section using the KrebsOnSecurity reporting on the $8M conviction as the procedural reference, then cut a paragraph that drifted into speculation about resale pricing.
• 2026-04-26 : Final pass: removed three speculative sentences about possible threat actors behind the open MongoDB, kept only what's documented in the Cybernews and Bright Defense reports.