- cross-posted to:
- technology@lemmy.world
- cross-posted to:
- technology@lemmy.world
- Full names
- Addresses
- Post codes
- Dates of birth
- National IDs
- Phone numbers *Genders
- Email addresses
- Telco metadata
- Breach status and social profile annotations
Good luck everyone.
You must log in or register to comment.
Now I have to go and get a new gender
Don’t worry I’m sure the government is working overtime to draft a new law requiring companies to collect even more personal info. They’ve got us covered
The fact this database even exists is pretty dubious from a data sovereignty point-of-view.
So nearly half the population (assuming do duplicates)? Fuck me dead.
Any idea how long until Have I Been Pwned is updated?
Here RSS link https://haveibeenpwned.com/feed/breaches/
Sadly I see a lot of victims of scams / identity fraud in my work.
My advice to people generally is:
Be vigilant, don’t click links in emails, don’t talk to people who call you, have conversations with the people you care about reminding them to also be vigilant.
For access to government services, set up the myId app for 2fa, don’t use SMS.
For other services, use a 2fa code generator, or SMS if that’s all thats available.
Use a password manager, but be wary that non-technical people might find this out of reach. Their browser’s built in password management is better than nothing.
Your State’s department of transport probably lets you lock your profile so your drivers license number can’t be used to verify your identity. Be aware that you’ll need to unlock this when you want to allow someone to confirm your id.
Similarly you can lock your credit rating at experian or equifax:
Misleading. Some researchers found an unsecured database, contacted the owners, and they secured it. There is no evidence of the data actually being leaked.
It’s not misleading. A database of personally identifiable information being exposed on the internet is a data leak. Personally identifiable information is legally required to be protected, while an exposed database on the internet is about as far from ‘protected’ as you can get.
The article and title make no claim to active selling or known exploitation of the data, but to write this off as nothing would be a mistake. Are you sure that only the Cybernews team found it?
The Cybernews team discovered the exposed MongoDB instance on November 11th, 2025 and immediately notified IDMerit. The company secured the database by November 12th.
We don’t know how long it was exposed for prior to it being discovered on the 11th - it might’ve been that day, it might’ve been a few months.
