Social security numbers exposed in National Public Data breach

National Public Data, a background check service, has fallen victim to hackers. The company’s database was sold on the internet, making the crucial data available for anyone.

According to BleepingComputer, the compromised database includes extensive personal data, featuring millions of people’s social security numbers, as well as their cell and home phone numbers, among other details.

The company disclosed that the potentially breached information includes names, email addresses, phone numbers, social security numbers (SSNs), and postal addresses. They stressed that this was related to a hacking attempt that occurred in late 2023.

The company is aware of two data leak incidents within the National Public Data system, in April 2024 and during the summer of 2024. It has contacted law enforcement, conducted an investigation, and checked the affected records. National Public Data has promised to notify affected individuals if any significant new information becomes available.

It is worth noting that access to the company’s statement on the security incident has been blocked for IP addresses in numerous locations, both within the US and internationally. However, multiple captures of the page can be found on the Internet Archive.

The leaked database, which contains an estimated 2.7 billion records, has been circulating among threat actors for several months. In April 2024, a hacker using the alias “USDoD” offered to sell the data for $3.5 million. Earlier this month, another threat actor named “Fenice” released a more extensive version of the database for free.

Even as the full extent of the data leak continues to be assessed, it has revealed personal details of a majority of the affected individuals and their relatives, many of whom are deceased. It should be noted that one of the databases studied by Troy Hunt, the creator of Have I Been Pwned, contained 134 million unique email addresses.

However, the data in the leaked database may also be inaccurate. For instance, an individual’s characteristics, such as a name or date of birth, may be incorrectly assigned to someone else. In turn, people reported to live in various cities around the globe may not actually be found there.

The National Public Data breach has caused at least one class action lawsuit against Jerico Pictures, the entity operating the National Public Data service. This company reportedly accessed and sold compromised data from a range of public records, including government files.

In response to this situation, affected individuals should monitor their financial accounts for signs of fraud and immediately report any issues to the relevant credit bureaus. Additionally, users targeted with phishing attempts should brace for further illegitimate schemes.

(Image by Gerd Altmann)

See also: AT&T data breach affects 109 million US customers

Unified Communications is a two-day event taking place in California, London, and Amsterdam that delves into the future of workplace collaboration in a digital world. The comprehensive event is co-located with Digital Transformation Week, IoT Tech Expo, Edge Computing Expo, Intelligent Automation, AI & Big Data Expo, and Cyber Security & Cloud Expo.

Explore other upcoming enterprise technology events and webinars powered by TechForge here.

Tags: connectivity, cybersecurity, data