3 Billion Hacked in National Public Data Breach, Including Social Security Numbers

(Image credit: Getty Images)

Nearly three billion individuals had their personal data leaked during a cyber attack targeting National Public Data (NPD), a background checking service also known as Jerico Pictures. The data breach is one of the biggest in history and surfaced when a proposed class action lawsuit was filed in early August.

The lawsuit alleges that personal data from nearly three billion people was leaked during a cyber attack targeting the company in April. Initially, neither NPD, nor Jerico Pictures confirmed the cyberattack.

But as of late August, NPD has confirmed the cyberattack and published a breach disclosure to its company website acknowledging a third-party had attempted to access data in the NDP's possession in December before appearing to leak the data in April and this summer.

From just $107.88 $24.99 for Kiplinger Personal Finance

Become a smarter, better informed investor. Subscribe from just ~~$107.88~~ $24.99, plus get up to 4 Special Issues

CLICK FOR FREE ISSUE

https://cdn.mos.cms.futurecdn.net/flexiimages/y99mlvgqmn1763972420.png

Sign up for Kiplinger’s Free Newsletters

Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.

Profit and prosper with the best of expert advice - straight to your e-mail.

Until the NPD breach, the Yahoo data breach in 2013 stood as the worst cyberattack in history. The first attack occurred in 2013, with more to follow over the next three years. Only after Verizon bought out Yahoo in 2017, did the actual number of records affected come to light. It was determined that all 3 billion of Yahoo's accounts were affected. That particular breach included the theft of names, email addresses, phone numbers and birthdates, but did not involve financial information.

What is National Public Data and what kind of data was stolen?

National Public Data is owned by Jerico Pictures, Inc. and is headquartered in Coral Springs, Florida. It is a background checking service that scrapes personally identifiable information of individuals from non-public sources. This means many of the people who were affected by the breach did not knowingly provide any of their personal information to NDP.

In their breach disclosure, NDP stated that "information that was suspected of being breached contained name, email address, phone number, Social Security number, and mailing address(es)."

They also said they had "cooperated with law enforcement and governmental investigators and conducted a review of the potentially affected records and will try to notify you if there are further significant developments applicable to you."

NDP suggests monitoring all of your financial accounts for unauthorized access/use, contacting the three U.S. credit reporting agencies, Equifax, Experian, and TransUnion, to obtain a free credit report from each by calling 1.877.322.8228 or by logging onto www.annualcreditreport.com. See below for more suggestions about how to protect your data and identity.

Were you part of the data leak?

Cyber security firm Pentester has set up a tool to let you determine if your data was part of the breach. Go to npd.pentester.com, enter your name and birth year to see a list of breached accounts, including the last four digits of the leaked Social Security numbers, at no charge.

What was learned from the lawsuit filed against NDP

The breach First became public when a lawsuit was filed against NDP alleging negligence, unjust enrichment, and breaches of fiduciary duty and third-party beneficiary contract.

On July 24, 2024, Christopher Hofmann received a notification from his identity theft protection service provider notifying him that his personally identifiable information (PII) was compromised as a direct result of the “nationalpublicdata.com” breach, and that his PII had been found on the Dark Web.

The lawsuit alleges that on April 8, 2024, a criminal gang that goes by the name of USDoD posted a database entitled “National Public Data” on a Dark Web hacker forum called “Breached.” USDoD alleged to have the PII of approximately 2.9 billion individuals and offered the database for purchase at a price of $3.5 million.

Hofmann v. Jerico Pictures, Inc., Docket No. 0:24-cv-61383 (S.D. Fla. Aug 01, 2024), Court Docket

Steps you can take to protect your identity and data

Identity theft plans available typically include some combination of account monitoring, alerts and restoration support. This means the plans can't stop criminals from targeting you and can only offer remediation assistance after the fact.

This breach highlights the fact that data breaches can arise despite the best intentions of individuals to protect and store their information safely. This information was scraped from nonpublic sources and stored without encryption or other safeguards.

"As the list of mega-breaches continues to grow, it is essential to consider investing in protective services that surpass the traditional practice of just monitoring changes in your credit report, particularly those that provide continuous surveillance of your bank accounts, your mailing address, and the dark web to detect any potential signs of identity theft at an early stage. Embracing the latest technology is crucial to safeguarding your identity" says ”Odysseas Papadimitriou, WalletHub CEO.

Here are some other suggestions from Wallethub for protecting your identity and data:

Sign up for 24/7 credit monitoring
Activate two-factor authentication
Don’t respond to unsolicited requests for information
Review credit card and bank accounts on a regular basis
Sign or use your PIN to verify debit card purchases
Place a free fraud alert on your credit file. A fraud alert tells creditors to contact you before they open any new accounts or change your existing accounts.
Freeze your three primary credit reports. In this context, "freezing" means that you prohibit your credit reports from being accessed by most third parties. In return for a fee you get a PIN from the credit bureaus. This PIN acts as an additional key and it must be given in order for your credit reports to be accessed and used to open accounts or obtain loans

Bottom line

This breach demonstrates third-parties can collect, store and lose your data all without your participation or knowledge. You must be vigilant in monitoring your accounts and mind your surroundings when using credit cards or when providing personal information.

Consider using a credit card for expenses and not your debit card. All major credit cards offer blanket liability against unauthorized credit card purchases. If your debit card is appropriated, your bank account could be drained and you will potentially face a lengthy process to try and recover your money. And by using a credit card and not a debit card, you'll also have the opportunity to rack up rewards you can spend elsewhere.

Donna joined Kiplinger as a personal finance writer in 2023. She spent more than a decade as the contributing editor of J.K.Lasser's Your Income Tax Guide and edited state specific legal treatises at ALM Media. She has shared her expertise as a guest on Bloomberg, CNN, Fox, NPR, CNBC and many other media outlets around the nation. She is a graduate of Brooklyn Law School and the University at Buffalo.