incident · 1711929600000

National Public Data Breach

National Public Data (NPD), a background check company, suffered a massive data breach exposing the personal information, including Social Security numbers, of millions of individuals.

What happened

A threat actor known as USDoD claimed to have stolen a database containing billions of records from National Public Data. The data, which included names, addresses, and Social Security numbers, was subsequently leaked on cybercrime forums.

Technical mechanism

The specific technical mechanism of the breach was not fully detailed, but it involved unauthorized access to NPD's databases, likely through compromised credentials or an exploited vulnerability, allowing the exfiltration of massive amounts of unencrypted personal data.

Why it matters

This breach is one of the largest compromises of personal data in recent history, exposing highly sensitive information (like SSNs) of a vast number of individuals, leading to significant identity theft risks and widespread class-action lawsuits.

Impact

The breach potentially impacted hundreds of millions of individuals, exposing their Social Security numbers, names, current and past addresses, and phone numbers. This created a severe risk of identity theft and fraud.

Response

National Public Data confirmed the breach, stating it involved a third-party bad actor. The company faced numerous class-action lawsuits and regulatory scrutiny. They advised affected individuals to monitor their credit reports.

Defensive lessons

  • Implement strong encryption for highly sensitive data like Social Security numbers at rest and in transit.
  • Enforce strict access controls and multi-factor authentication for database access.
  • Conduct regular security audits and penetration testing on systems holding massive volumes of PII.

Evidence register

  1. National Public Data — Security Incident (verified)