1 Billion Identity Records Just Leaked.
The Company Hired to Stop Fraud Caused It.

Aye. Let me get straight to it because this one is serious.

IDMerit is a company you’ve probably never heard of. But here’s what you need to understand: they know everything about you. IDMerit is a KYC — Know Your Customer — identity verification firm. Banks, fintech lenders, and financial institutions pay them to confirm that the person applying for an account or a credit line is actually who they say they are. They sit at the exact moment between you and a new financial product.

And they just left their entire database open. No password. No encryption. Completely unprotected MongoDB database sitting on the internet for anyone who knew where to look.

Over 1 billion records. 26 countries. 203 million Americans. Full names, home addresses, dates of birth, national ID numbers — the complete identity package. This isn’t a breach in the traditional sense where hackers broke in. It was just… open. The company built to verify your identity couldn’t protect it.

Security researcher Jeremiah Fowler discovered the exposed database and reported it to Cybernews. IDMerit has since secured the database, but there’s no way to know how long it was accessible or who already downloaded it before Fowler found it.

Let me break down exactly what happened, why this matters more than any breach you’ve seen this year, and the five moves you need to make today.

What IDMerit Does — And Why This Breach Is Different

Most data breaches happen at companies you interact with directly — your bank, your insurer, a retailer. You can trace the exposure back to a relationship you had.

IDMerit operates in the background. You never signed up with them. You never gave them your information directly. But they have it anyway — because every financial institution that ran a KYC check on you may have used their platform to do it. This is the infrastructure layer of financial identity.

The exposed database contained records collected from 26 countries as part of KYC compliance operations for financial institutions. According to Cybernews, the data included:

• ✓
  Full legal names — exactly as they appear on government-issued ID documents
• ✓
  Home addresses — current and historical addresses used in identity verification
• ✓
  Dates of birth — combined with name and address, this is the core identity package
• ✓
  National ID numbers — in the US context, this means SSN or government ID numbers used for KYC compliance
• ✓
  Phone numbers and email addresses — contact data used to send verification codes
• ✓
  Document metadata — information about the types of ID documents submitted for verification

This is not partial data. This is a complete identity dossier on over a billion people — collected by a company whose entire purpose was handling the most sensitive identity data in existence.

“The irony is devastating: a company built to prevent identity fraud just handed fraudsters the most complete identity dataset ever leaked in a single exposure.”

The Direct Credit Threat You Need to Understand

Here’s what I need you to understand that the mainstream coverage is going to gloss over: this breach is uniquely dangerous for your credit file because of what the data was designed to do.

Normal stolen data — email addresses, passwords, even SSNs — still requires fraudsters to assemble a working identity profile from pieces. IDMerit’s data was collected, verified, and formatted specifically to pass financial identity checks. It’s pre-packaged for fraud.

Here’s how the attack chain leads straight to your credit report:

• 1
  Fraudulent credit applications — With a complete, verified identity package, bad actors apply for credit cards, personal loans, and auto loans in your name. Each application creates a hard inquiry. Approved accounts get maxed out and defaulted. All of it shows up on your credit report.
• 2
  Synthetic identity fraud — Fraudsters blend real verified data with fabricated elements to create synthetic identities that pass automated KYC checks. These synthetics get used to build credit lines that damage the real consumers whose data was borrowed.
• 3
  Account takeover — Armed with your full identity profile plus verification-formatted data, fraudsters contact financial institutions, pass security questions, and take over existing accounts. They change contact info so you stop getting alerts and they drain or misuse the account.
• 4
  KYC bypass at new institutions — The same data format used to pass legitimate KYC checks gets used to open fraudulent accounts at institutions that rely on IDMerit’s verification infrastructure. Your identity gets used to pass the check you were supposed to be protected by.

Who Is Most at Risk

With 203 million American records exposed, the honest answer is: a lot of people. But certain situations elevate your risk:

• ▶
  Anyone who’s opened a financial account in the last 10 years — KYC became widespread across fintech and banking starting in the mid-2010s. If you’ve opened a bank account, applied for credit, or signed up for a fintech app, you’re potentially in this dataset.
• ▶
  Thin-file consumers rebuilding credit — People with limited credit history are disproportionately targeted by fraudsters who want to use clean files. A new fraudulent account on a thin file does more damage proportionally.
• ▶
  Anyone currently applying for a mortgage, auto loan, or business credit — Active credit seekers are most exposed to fraudulent applications that could complicate your approvals and tank your score during the process.
• ▶
  People who haven’t monitored their credit recently — The longer fraudulent items sit on your report uncontested, the harder they are to remove and the more damage they do.

What You Need to Do Right Now

I’m not giving you general advice. Here are five specific actions in the order you should do them today.

• 1
  Freeze your credit at all three bureaus — right now, today. Go to Equifax.com/personal/credit-report-services, TransUnion.com, and Experian.com. Each has a free security freeze option. It takes about five minutes per bureau. Once frozen, no new credit can be opened in your name without you manually unfreezing it. This is the single most powerful protective action you can take. Do this first before anything else.
• 2
  Pull all three credit reports immediately. Go to AnnualCreditReport.com — the only federally mandated free report site. Pull all three: Equifax, TransUnion, and Experian. Screenshot or download them. You want a baseline of your current report status before any fraudulent activity potentially appears. Look specifically for hard inquiries you don’t recognize and accounts you didn’t open.
• 3
  Place a fraud alert at one bureau. Call or go online to place a fraud alert at any one of the three bureaus — they’re required to notify the other two. A standard fraud alert is free and lasts one year. It requires creditors to take extra steps to verify identity before approving new credit. If you find fraudulent accounts, file a report at IdentityTheft.gov first, then request an extended 7-year fraud alert.
• 4
  Change passwords on all financial and email accounts. Start with your primary email (especially any you’ve used for financial signups), then bank accounts, investment accounts, and credit monitoring platforms. Use a unique password for every account. Enable two-factor authentication everywhere it’s available — ideally app-based 2FA (Google Authenticator, Authy) rather than SMS.
• 5
  Dispute any unauthorized items immediately. Under the FCRA (15 U.S.C. § 1681), you have the right to dispute any inaccurate or fraudulent information on your credit report. Bureaus must investigate within 30 days. If you find fraudulent hard inquiries or accounts, dispute them directly with each bureau and request that they be investigated as fraud, not just an inaccuracy. You’re entitled to have them removed.

The Bigger Problem Nobody Wants to Say Out Loud

Say man — I need to be real with you about the pattern here, because this IDMerit breach doesn’t exist in isolation.

2024 gave us National Public Data — 2.9 billion records. 2025 gave us multiple major breaches at financial data intermediaries. Now in 2026 we have IDMerit — 1 billion records from the identity verification layer itself. The infrastructure that’s supposed to protect consumer identity is the thing getting compromised.

At the same time, the CFPB — the agency that actually investigated data broker violations, processed 5 million consumer complaints per year, and held credit bureaus accountable for how they handle breached data — is being systematically dismantled. The enforcement layer is weakening at exactly the moment the threat is escalating.

This is not bad luck. This is a systemic failure that puts the entire burden of protection on individual consumers who don’t have the resources or the information to fight back. That’s why we’re here.

“Your credit identity isn’t protected by the system anymore. It’s protected by how informed you are and how fast you act. That’s the reality in 2026.”

The good news: most people won’t act. They’ll read a headline, feel vaguely worried, and do nothing. You’re reading this. That puts you ahead. Freeze your credit today and you’ve already done more than 90% of the 203 million Americans in this dataset.

Once your identity is locked down and your credit is clean, the next move is building. NMD Solutions gives people with rebuilt credit access to off-market property deals — probate, pre-foreclosure, and investor-grade opportunities that don’t hit Zillow. Check out what we have at nmdzaza.github.io/nmd-solutions/.

The Bottom Line

IDMerit exposed 1 billion identity records because they didn’t put a password on their database. The company that exists to verify your identity couldn’t protect it. That data is now in circulation.

You have five moves. Credit freeze. Pull your reports. Fraud alert. Change your passwords. Dispute anything unauthorized. None of it costs money. All of it takes less than two hours. The protection window is now — before fraudulent items start appearing.

Don’t wait for a notification letter. Those come months later, after the damage is done.

Stay locked in — Za | NMD ZAZA 🐐