National Public Data, a data aggregator and background checking service, confirmed a data breach last week totalling around 2.9 billion records. The breach contains data mostly on people from the United States, Canada and the United Kingdom, containing full names, addresses SSNs, SINs and NINs.
The breach appears to be most likely attributed to a group going under the alias USDoD, who posted the data set for sale in April 24 for $3.5 million. This attribution is still not confirmed as several other threat actors appear to have had access to the data, with one going under the pseudonym of Fenice sharing a subset of the full data set containing 2.7 billion records for free.
The data set seems to contain at least 134 million unique email addresses, as discovered by Troy Hunt of Have I Been Pwned. The exact number of impacted individuals however is still not fully known, there appears to be multiple records for each individual, with varying addresses, name spellings, telephone numbers, email addresses and combinations of the above. Whilst a large number of the records appear to be outdated, enough are still relevant to be of concern, especially those containing social security, social insurance and national insurance numbers as these identifiers can be nigh on impossible to change.
There are several class action lawsuits being launched in the US already, mostly targeting Jerico Pictures, the entity that owns and operates the National Public Data business.
KrebsOnSecurity has as usual provided a fantastic write up of the incident so far and identified the fact that a sister organisation to NPD, recordcheck.net, was hosting an older archive that contained the sites full administrator usernames and passwords.
Interestingly enough, Gibson Research Corporation’s Steve Gibson noted on the Security Now podcast that individuals using the majority of respected online data removal tools did not have their data contained with the leaked data sets.
Here’s some suggested further reading from Troy Hunt and Brian Krebs with greater detail and fantastic insights into the whole situation:
https://www.troyhunt.com/inside-the-3-billion-people-national-public-data-breach/
https://krebsonsecurity.com/2024/08/nationalpublicdata-com-hack-exposes-a-nations-data/
https://krebsonsecurity.com/2024/08/national-public-data-published-its-own-passwords/
If you are worried about your data loss at an organisational scale, do please get in touch as there are a number of tools and services available that we can help you with.
