National Public Data confirms breach exposing Social Security numbersNational Public Data confirms breach exposing Social Security numbers

In August 2024, National Public Data, a Florida-based background-check service operated by a company called Jerico Pictures, confirmed that hackers had stolen a vast collection of personal records. The firm said a malicious actor had tried to access its systems starting in late December 2023, and that data was leaked in a series of releases in April and summer 2024. Its confirmation came only after the data had been posted publicly and reported widely.

In April 2024, a hacker using the name USDoD advertised a database said to contain 2.9 billion records on people in the United States, Canada and the United Kingdom, asking about $3.5 million. Portions leaked over the following months, and in August a much larger version was published for free on a hacking forum. National Public Data did not publish a technical explanation of how its systems were compromised.

The records included names, Social Security numbers, dates of birth, mailing addresses with historical addresses, phone numbers and email addresses. The headline figure refers to rows of data rather than unique individuals, since many people appeared multiple times with different addresses. Analysis by researchers, including breach notification service Have I Been Pwned, found about 134 million unique email addresses, and testers found that some entries contained outdated or mismatched details. Even so, the leak placed working Social Security numbers for a large share of Americans in public circulation.

The fallout was rapid. Multiple class-action lawsuits were filed against Jerico Pictures, and in October 2024 the company filed for bankruptcy, citing the litigation and potential liabilities it could not meet. Its website was taken offline. Because the firm had few assets, victims had little prospect of meaningful compensation, and state regulators and lawmakers pointed to the case as evidence that data brokers face too little oversight.

The breach drew attention to an industry most consumers never deal with directly. National Public Data compiled information from public records and other sources to sell searches to employers, landlords and investigators, yet the people in its files had no relationship with the company and no say in how the data was protected. Security experts urged Americans to freeze their credit files at all three bureaus, the most effective defense against misuse of a stolen Social Security number.