Connect with us

Technology

1 billion identity records exposed in ID verification data leak

Published

on

1 billion identity records exposed in ID verification data leak

NEWYou can now listen to Fox News articles!

Things like your name, home address, date of birth and even your Social Security number may have been sitting on the open internet. Researchers say an unprotected database tied to IDMerit, a company that claims to help businesses verify identities, exposed roughly 1 billion sensitive records across 26 countries.

In the United States alone, more than 203 million records were left unsecured. This involves the exact documents and details companies use to confirm you are really you. If criminals get that kind of information, they’d have everything they need.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

BE AWARE OF EXTORTION SCAM EMAILS CLAIMING YOUR DATA IS STOLEN

Advertisement

Researchers say an exposed database tied to IDMerit left roughly 1 billion sensitive identity records visible on the open internet. (Morteza Nikoubazl/NurPhoto via Getty Images)

What you need to know about the massive data leak

Researchers at Cybernews, a cybersecurity news and research publication, discovered an exposed MongoDB database on Nov. 11, 2025, that they believe belongs to IDMerit, a global identity verification provider that serves banks, fintech firms and other financial services companies. IDMerit uses artificial intelligence tools to help businesses perform KYC, short for Know Your Customer, which is the identity verification process required when you open financial accounts.

The database was not protected by a password. Anyone who knew where to look could access it. Inside were full names, home addresses, postal codes, dates of birth, national ID numbers, phone numbers, email addresses and gender information. Some records also included telecom-related metadata and internal flags that may have referenced past breaches.

The exposure affected people in 26 countries. The United States had the highest number of exposed records at more than 203 million. Mexico, the Philippines, Germany, Italy and France were also heavily impacted.

Researchers notified the company, and the database was secured the following day. There is currently no public evidence that criminals downloaded the data. Still, it’s worth noting that automated bots constantly scan the internet for exposed databases and can copy them within minutes.

Advertisement

YOU COULD BE SHARING YOUR SOCIAL SECURITY NUMBER WHEN YOU DON’T NEED TO

The unsecured database reportedly contained highly sensitive details including names, home addresses, dates of birth and national ID numbers. (Silas Stein/picture alliance via Getty Images)

How it happened and why it matters for you

When you open a bank account, sign up for a crypto platform or verify your identity for a financial app, you are often asked to upload a government ID and provide personal details. Companies like IDMerit process that information behind the scenes. That means this database likely contained the same details you would use to prove your identity to a bank or government agency.

For criminals, that is gold. With your full name, date of birth, national ID and phone number, scammers can attempt SIM-swap attacks. This is when someone convinces your mobile carrier to transfer your phone number to their device. Once they control your number, they can intercept security codes sent by text message and break into your bank or email accounts. They can also launch highly targeted phishing scams. Imagine receiving a call or email that includes your real home address and ID number. It would feel legitimate, and that’s exactly the point.

Because the data was neatly organized, criminals could sort it by country or other details and use automated tools to target huge numbers of people with scams.

Advertisement

We reached out to IDMerit for comment, but did not hear back before our deadline.

FIGURE DATA BREACH EXPOSES NEARLY 1M ACCOUNTS

Experts warn that data like this can help criminals launch SIM swap attacks and highly targeted phishing scams. (Kurt “CyberGuy” Knutsson)

8 ways you can protect yourself from data leaks

Before criminals have a chance to use this information against you, here are practical steps you can take right now to lock things down and reduce your risk.

1) Freeze your credit reports

Contact the major credit bureaus in your country and place a credit freeze. This prevents criminals from opening loans or credit cards in your name. Even if someone has your national ID and date of birth, lenders will not be able to access your credit file without your permission.

Advertisement

2) Stop relying on text message security codes

If your bank or email account still uses SMS codes for two-factor authentication, switch to an authenticator app instead. Text messages can be intercepted during SIM-swap attacks. An authenticator app generates codes directly on your device, making it much harder for criminals to break in.

3) Use a password manager

If attackers pair leaked identity data with passwords from older breaches, they can try to access your accounts. A password manager creates strong, unique passwords for every account, so one leak does not unlock everything else.

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

4) Consider identity theft protection

Identity theft monitoring services can alert you if your personal information is used to open accounts or appears on dark web marketplaces. Early detection can mean the difference between stopping fraud quickly and discovering it months later. See my tips and best picks on Best Identity Theft Protection at Cyberguy.com

5) Watch your mobile account closely

Log in to your mobile carrier account and enable extra security features, such as a port-out PIN if available. This adds an additional layer of protection so someone cannot easily move your phone number to another SIM card.

Advertisement

6) Run antivirus software on your devices

Good antivirus software can block malicious links, fake login pages and spyware that may be used in follow-up attacks. After a large data exposure, phishing campaigns often spike, and having protection in place can stop you from clicking into trouble. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

7) Consider a personal data removal service

Your personal information is often scattered across data broker sites and people-search databases that sell access to your details. A personal data removal service can monitor where your information appears online and work to get it taken down. This reduces the amount of data criminals can find about you in one place, making it harder for them to piece together your identity and target you with scams or fraud. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

8) Be skeptical of calls that know too much

If someone contacts you and references your address, date of birth or ID number, do not assume they are legitimate. Hang up and call the official number listed on the company’s website. Criminals use real data to make fake stories sound convincing.

Kurt’s key takeaway

This incident exposes a larger problem. Companies that handle identity verification have become critical infrastructure for the digital economy. When one of them leaves a database open, the fallout spreads across countries and millions of ordinary people who never even heard of the company. You trusted a bank or app with your ID. That bank trusted a third party. Somewhere in that chain, basic security controls failed.

Should companies that handle identity verification face automatic penalties when they expose millions of people’s most sensitive data? Let us know by writing to us at Cyberguy.com.

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

Copyright 2026 CyberGuy.com. All rights reserved.

Technology

DJI’s new Mic Mini 2 adds colorful covers to help them blend in

Published

on

DJI’s new Mic Mini 2 adds colorful covers to help them blend in

As with the Osmo Pocket 4 and recent Lito drones, DJI has no plans to release the Mic Mini 2 in the US, but it’s now available in most other markets. Pricing starts at €59 (around $69) for a bundle that includes a single mic transmitter, a compact USB-C wireless receiver, and a smaller charging case. There are several additional bundles available, including a €99 (around $116) option with two mic transmitters, a larger version of the wireless receiver that can be used with cameras, and a charging case large enough to accommodate them all. Obsidian black and glaze white magnetic covers are included, while 12 more colorful alternatives are sold separately.

The Mic Mini 2 transmitters are slightly larger and a gram heavier than the originals as a result of the redesign that accommodates the covers. But they’re much smaller than the Insta360 Mic Pro’s transmitters that will feature a customizable color E Ink screen. Battery life remains the same at 11.5 hours for the Mic Mini 2 with ANC turned off and 10.5 hours for the receiver, while the wireless transmission distance still maxes out at just over 1,312 feet. There’s still no redundant on-mic recording, but DJI teased a Mic Mini 2S version with that feature as part of today’s announcement that it claims will be announced this summer.

Continue Reading

Technology

You could get paid from Google’s Android data lawsuit

Published

on

You could get paid from Google’s Android data lawsuit

NEWYou can now listen to Fox News articles!

If you use an Android phone, there is a good chance this case affects you. Google has agreed to a $135 million settlement over claims that its Android system used people’s cellular data without permission. The part that caught our attention is when it allegedly happened.

According to the lawsuit, these data transfers could take place in the background, even when your phone was not in use. Most people assume that if their screen is off, nothing is happening. That isn’t always the case.

Sign up for my FREE CyberGuy Report

  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

HACKERS ABUSE GOOGLE CLOUD TO SEND TRUSTED PHISHING EMAILS

The lawsuit claims Android software sent data to Google in the background, even when the phone was not in use. (John Keeble/Getty Images)

Advertisement

 

What the lawsuit says your Android phone was doing

At the center of this case is how Android handled background activity. The lawsuit claims Android devices were sending information back to Google servers without clear user consent. This reportedly happened over cellular networks, which means it may have used data you were paying for.

That detail matters. If something runs over Wi Fi, most people do not think twice about it. Cellular data is different. It is limited for many users and often tied to monthly costs.

The plaintiffs argue that Google could have restricted these transfers to Wi Fi. Instead, they say the system used cellular connections, which shifted the cost to users. Google has denied wrongdoing but agreed to settle the case.

“We are pleased to resolve this case, which mischaracterized standard industry practices that keep Android safe. We’re providing additional disclosures to give people more information about how our services work,” José Castañeda, a Google spokesperson, told CyberGuy.

 

Who may be included in the settlement?

This case covers a huge number of people. If you used an Android device on a cellular network at any point after November 12, 2017, there is a good chance you are part of the group. The only major exception is if you are already included in a similar case called Csupo v. Google LLC. Estimates suggest around 100 million users could qualify. That makes this one of the larger consumer tech settlements tied to everyday phone use.

Advertisement

 

How much you might actually receive

Before you start planning how to spend it, this is likely to be a modest payment. The settlement fund is $135 million. When that is divided across millions of people, the amount per person will depend on how many claims are filed. In most cases like this, payments tend to be small. Think of it as getting reimbursed for something you did not realize was costing you.

ALLSTATE SUED FOR ALLEGEDLY TRACKING AND SELLING 45M AMERICANS’ LOCATION DATA

The case focuses on whether those background transfers used cellular data that users were paying for. (Kury “CyberGuy” Knutsson)

 

How to claim your payment

The process is already underway, but it is simpler than most people expect. In many cases, you do not need to file a full claim form to be included. If you qualify, you are already part of the settlement unless you choose to opt out.

That said, there are a few steps worth taking to make sure you actually get paid.

Advertisement
  • Start by checking your email or physical mail for a notice about the settlement. Some users are receiving a class member ID or notice code, which makes the process faster.
  • Next, visit the official settlement website at federalcellularclassaction.com and confirm your eligibility. This is also where you can enter or update your payment details. You will typically be able to choose how you want to receive your money, including options like direct deposit or popular payment apps.
  • If you do nothing, you may still receive a payment automatically, but there is a higher chance of delays or missed payments if your information is outdated. You only need to take extra steps if you did not receive a notice, your contact details have changed, or you want to opt out or object to the settlement.

 

The timeline you need to know

There are a couple of important dates to keep in mind. The deadline to opt out or object to the settlement is May 29, 2026. The final approval hearing is scheduled for June 23, 2026. If the court approves the deal, payments will follow after that process wraps up.

 

Why this situation matters beyond the settlement

This case taps into something bigger than one payout. Smartphones are designed to stay connected at all times. That includes background activity that most people never see. While that constant connection powers useful features, it also creates gray areas around consent and cost.

Situations like this raise a simple question. How much do you really know about what your phone is doing behind the scenes? It also puts pressure on companies to be clearer about how data is used and when it is being transmitted.

We reached out to Google for comment, but did not hear back before our deadline. 

The $135 million settlement could lead to payments for Android users who used cellular data after 2017. (Kurt “CyberGuy” Knutsson)

 

What the Android data lawsuit means for you

Even if the payout ends up being small, the takeaway here matters more than the money. Your phone may be using data in ways you do not notice. That includes apps you rarely open and system services running in the background. Taking a few minutes to check your settings can give you more control.

Advertisement

 

Check which apps are using background data

(Settings may vary depending on device manufacturer)

Samsung/Android: Go to Settings > Connections > Data usage > Mobile data usage >  then tap an app to see its data use and background activity.

 

Limit background data for specific apps

(Settings may vary depending on device manufacturer)

Samsung/Android: Go to Settings > Connections > Data usage > Mobile data usage > tap an app > toggle Allow background data usage off

This stops the app from using cellular data when you are not actively using it.

Advertisement

Reduce data use for updates and backups

(Settings may vary depending on device manufacturer)

Go to Settings > Software update > Auto download > Using Wi-Fi only

For apps, open the Google Play Store > tap your profile > Settings > Network preferences > App download preference > choose Over Wi-Fi only > OK

These small changes can help you avoid using cellular data without realizing it and give you more visibility into what your phone is doing behind the scenes.

Advertisement

Take my quiz: How safe is your online security?

Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my quiz here: CyberGuy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

 

Kurt’s key takeaways

This case is a reminder that the devices we rely on every day are doing more than we see. Most of the time, that works in your favor. Sometimes, it raises questions about transparency and control. Google chose to settle without admitting fault. That leaves room for debate about what really happened. It also highlights how quickly technology can outpace what users expect or understand. As phones become even more connected, these kinds of cases will likely keep coming.

Should companies like Google be allowed to use your cellular data in the background without clear permission, even if it powers features you rely on every day? Let us know your thoughts by writing to us at CyberGuy.com

Advertisement

Sign up for my FREE CyberGuy Report

  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com.  All rights reserved.

Continue Reading

Technology

Google is testing AI chatbot search for YouTube

Published

on

Google is testing AI chatbot search for YouTube

Google is trying out an AI Mode-like search experience for YouTube. The company is now testing “a new way to search on YouTube that feels more like a conversation,” with results pulling in things like longform videos, YouTube Shorts, and text about what you’re searching for. The “experiment” is now available if you’re a YouTube Premium subscriber in the US who is 18 or older.

I turned it on for my account. Now, in the search bar, I see an “Ask YouTube” button, and clicking the search bar shows prompts to ask like “funny baby elephant playing clips,” “summary of the rules of volleyball,” and “short history of the Apollo 11 moon landing.” If I keep the search box blank but click the Ask YouTube button, YouTube takes me to a full page with suggested searches and a text box to ask a question.

When you search with Ask YouTube, YouTube briefly shows a mostly-blank page with a loading icon, and after a few seconds, fills it out with text and details. I tested it with the “short history of the Apollo 11 moon landing” prompt. At the top of the results was a bunch of text summarizing the mission, including a bulleted list of milestones like the date of the lunar landing and Neil Armstrong’s first step on the Moon. Then, the page included a video about the launch timestamped to a section about the launch day from a channel called “The Life Guide,” followed by galleries of videos under headers like “From Launch to Splashdown,” “Historic Footage and Behind-the-Scenes,” and a series of Shorts about “Moments on the Surface.” (I assume YouTube is pulling the text for these sections from the videos highlighted in the search results.)

At the end, the page has a few more suggested prompts, including “Who were the Apollo 11 astronauts” and (perhaps worryingly) “Apollo 11 conspiracy theories,” and a text box I can use to ask a follow-up question or start a new search. I clicked the “Who were the Apollo 11 astronauts” and got a new, slightly differently-formatted set of results, including a grid with background about astronauts Neil Armstrong, Buzz Aldrin, and Michael Collins. Searching for “Apollo 11 conspiracy theories” just showed a typical list of YouTube search results, however.

I threw Ask YouTube another test to see how it fared with something I’m very familiar with: Valve’s new Steam Controller, which I published a review of today. I asked, “What is the Steam Controller,” and YouTube gave an overview of the controller, pointed to Valve’s new video about the controller, and highlighted both longform reviews and a “Quick Hands-On Reviews” section featuring Shorts (including our new Short published today and one from last November).

Advertisement

It was all mostly right, but I did catch a factual flub: YouTube claimed that the old, discontinued Steam Controller had no joysticks, when it actually has one. It was a reminder that, as potentially useful as these AI-created search result pages might seem, you need to do your due diligence to make sure they’re accurate.

Continue Reading
Advertisement

Trending