IDMerit AI Identity Verification MongoDB Leak — February 2026
A misconfigured MongoDB instance exposed identity-verification records — government IDs, selfies, biometric metadata — from AI-powered KYC vendor IDMerit.
- Government ID images
- Selfies
- Biometric metadata
- Verification records
A misconfigured MongoDB instance exposed identity-verification records from the AI-powered KYC vendor IDMerit. The leaked dataset includes government ID images, selfies, and biometric metadata — the worst possible combination for identity-theft and deepfake operations.
This is one of the most severe categories of data exposure. ID images plus selfies are the input that lets attackers bypass downstream KYC checks at financial institutions, dating apps, and any service that uses photo-ID verification. For high-profile executives and creators whose IDs were processed through IDMerit (often for crypto exchanges, fintech onboarding, or content-platform verification), the impact extends to long-term identity-fraud risk.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary DoxxScan™ to see if their identity is exposed in the breaches we cover.
Were you affected by this breach?
See exactly what an attacker can piece together from your email, username, or handle. Free first scan, no credit card.
Try DoxxScan — 72hr free trial →