National Public Data Confirms Huge Social Security Breach

Florida-based Jerico Pictures Inc., the Coral Springs, an entity that does business as National Public Data (NPD), confirmed the “data security incident” that potentially leaked every American’s Social Security number (SSN) to identity thieves. According to the company’s notice, “a third-party bad actor” has stolen billions of records, including names, email addresses, phone numbers, social security numbers, and mailing addresses.

NPD, which collects information from non-public sources and uses it to conduct background checks for employers and investigators, said the massive data theft started with attempts to hack their servers in December 2023, followed by “potential leaks of certain data in April 2024, and summer 2024.”

The company didn’t specify how many people the breach affected. A class-action lawsuit filed in U.S. District Court in Fort Lauderdale, Florida, states that a hacking group known as USDoD claimed responsibility for stealing the personal records of 2.9 billion people from National Public Data in April. Since August, plaintiffs have filed at least eight separate lawsuits against NPD.

An X post by a cybersecurity expert shows the hacking group posted the claims on a popular dark web forum, offering to sell the stolen data, which contained records from the United States, the United Kingdom, and Canada, for $3.5 million.

In its website announcement, NPD assured that it has taken “additional security measures in efforts to prevent the reoccurrence” and increase user protection. The company also said it works with law enforcement to detect stolen records and will “try to notify” individuals “if there are further significant developments applicable” to them.

In an email, NPD informed individuals that it had “purged the entire database of all entries,” effectively opting everyone out and deleting non-public personal information. The company might still need to retrieve records to comply with legal obligations.

NPD advises users to monitor their financial accounts for any suspicious or unauthorized activity and take steps to prevent misuse of their information. One recommended step is to request a free credit report from the three major credit reporting agencies – Equifax, Experian, and TransUnion – and set a fraud alert on their file. This alert requires creditors to contact account holders if anyone attempts to change existing account credentials or open new accounts.