National Public Data Confirms Massive Breach

Data aggregator National Public Data (NPD) has finally confirmed a breach that has exposed personal identity records belonging to potentially hundreds of millions of consumers across the US, UK, and Canada.

In a statement that offered little details, the Coral Springs, Fla.-based company acknowledged what numerous others have reported in recent days about a "third-party bad actor" accessing data from NPDs databases sometime in April 2024. The company described the data which the threat actor accessed as including full names, email addresses, phone numbers, Social Security numbers, and mailing addresses belonging to an unknown number of people.

Real and Accurate Data

NPD's advisory contained the usual boilerplate language about the company taking steps to protect against a similar incident but left it entirely up to victims to take measures to protect themselves against ID theft and other fraud resulting from its security lapse. NPD is a data aggregator that claims businesses, private investigators, human resources departments, and staffing agencies use its data for background checks, to obtain criminal records and other uses.

News of the breach has been circulating since at least April when Dark Web Intelligence posted on X about "USDoD" a hacker with a reputation for previous data heists, having obtained a database from NPD containing some 200 gigabytes of personal information on residents in the US, UK, and Canada. The threat actor claimed the NPD database contained some 2.9 billon rows of records. Many have incorrectly reported that as the number of victims instead in characterizing the breach as one of the biggest ever of private data.

Related:Russian Spy Agency Hackers Breach Human Rights Groups, Victims Say

VX-underground, a community focused on malware and cybercrime, reviewed the dataset and assessed the leaked data as being "real and accurate" and containing the first name, last name, SSN, current address, and addresses for individuals going back over 30 years. "It also allowed us to find their parents, and nearest siblings," VX-underground said. "We were able to identify someone's parents, deceased relatives, Uncles, Aunts, and Cousins."

Continue Reading This Article on Dark Reading