National Public Data (NPD), a company specialising in background checks, has confirmed a major data breach that exposed sensitive personal information, including Social Security numbers. This comes after months of reports on dark web forums where hackers have been advertising stolen data attributed to NPD.
The breach is believed to have occurred due to a malicious actor attempting to infiltrate the company’s systems in late December 2023, with potential data leaks surfacing in April and the summer of 2024. The compromised information reportedly includes names, email addresses, phone numbers, and mailing addresses, affecting approximately 2.9 billion records, although the exact number of individuals impacted remains unclear.
NPD’s recent security incident notice provided some details but left many questions unanswered. The company stated that it is cooperating with law enforcement and has conducted a review of the affected records. However, it has not disclosed how many individuals were impacted, nor does it offer compensation or direct contact options for those affected.
Instead, NPD advises individuals to monitor their credit reports for any unusual activity and that it “will try to notify you if there are further significant developments applicable to you.”
The breach gained public attention following a class-action lawsuit filed in U.S. District Court in Fort Lauderdale, Florida, which alleged that the hacker group USDoD accessed unencrypted personal information from NPD’s database.
This group reportedly offered the stolen data for sale on the dark web for $3.5 million, with claims of having records for billions of individuals.
Security experts recommend that individuals take proactive measures, such as freezing their credit reports and setting up fraud alerts with major credit bureaus, to mitigate the risk of identity theft. The breach has raised concerns about the security of personal data, emphasising the need for higher standards in data protection practices.
National Public Data, located in Coral Springs, Florida, specialises in providing background checks for employers, investigators, and various businesses seeking to verify individuals’ backgrounds. According to its website, the services offered include searches for criminal records, vital records, Social Security number traces, and additional information.
There are numerous companies similar to NPD that aggregate public data to compile consumer profiles, which they subsequently sell to other businesses, as noted by Cliff Steinhauer, director of information security and engagement at The National Cybersecurity Alliance, a nonprofit that promotes online safety.
“They are data brokers that collect and sell data about people, sometimes for background check purposes,” he said. “It’s because there’s no national privacy law in the U.S.—there is no law against them collecting this data against our consent.”