Recently, many people learned their personal information had been exposed in a breach at a largely unknown consumer data broker named National Public Data. The information included in the breach consisted of social security numbers, names, addresses, and other related information.
Here we take a look at what we know about the breach, what’s at risk, and how you can protect yourself.
Who is National Public Data (NPD)
National Public Data is a Florida-based organization that is also known as Jericho Pictures. It primarily conducts background checks on collecting data on individuals and processing background checks on individuals for businesses.
The Breach and the Data Stolen
The hack or breach of the company occurred in December 2023 but there was no confirmation of the incident until August 2024. The breach is one of the largest in history and only came to light when a class action lawsuit was filed against the organization.
The organization operates by scraping the PI data from non-public sources. As a result, the breach affected a large number of people.
Nearly 2.7 billion rows of records from the breach were leaked, which began to appear in cybercriminal groups in April, posted by a threat actor operating as USDoD.
The data stolen included social security numbers, names, addresses and other related personal information. The HaveIBeenPwned breach tracking service, in addition to a security analyst known at vx-underground on Twitter, concluded that the leaked data matched the data first listed for sale in April 2024 by USDoD.
According to Atlas Data Privacy Corp researchers, there were 272 million unique social security numbers in the entire record set. Most of these records have a name and address and approximately 26% had a phone number, according to Atlas.
Stranger Things
There are some interesting twists to this story. Sal (Salvatore) Verini, Jr. owns Jericho Pictures Inc., which runs NPD. Sal is a retired deputy with the Broward County Sheriff’s office. While the website for the company isn’t currently working, cached versions show it is a film studio with offices in South Florida and Los Angeles.
Further investigation into Mr. Verini revealed a few possible sources for the data collected by NPD. These include other businesses and domains set up to run background checks using data from birth, marriage and death records; professional licenses; voting records, and federal and state criminal records.
Analysts are not yet certain how the hackers accessed these records from NPD. What is known is that data was traded between different parties after it was originally stolen.
Is Your Identity Information Stolen?
If this is the first you’re hearing or reading about the National Public Data breach, and you want to know whether your data was stolen in the NPD breach, there are a couple of places providing this type of search services.
HaveIBeenPwned
HaveIBeenPwned takes its name from video game culture and is a leetspeak derivative of the word “owned.” From its home page, you can check if your email address is included in any breaches. Has been offering look-up services following one of the largest breaches of customer accounts at Adobe. They offer a lot of insight into their service and the niche in general in their FAQs.
Pentester
Soon after the National Public Data breach became public, Pentester, a cybersecurity platform, began offering a search for individuals to check if their personal information had been stolen.
NPD Breach
Data Dividend Protect and the Atlas Project are responsible for creating and maintaining NPDBreach. It provides a straightforward form that allows people to check to see if the breach has affected them.
Protecting Your Personal Identity Information
Security analysts and identity professionals all recommend taking specific actions to protect personal information such as social security numbers, addresses, email addresses, telephone numbers and more. The first is routinely checking credit reports for an unusual or unknown activity. There are also credit monitoring services available from all three credit bureaus and as of June 2024, they are also providing weekly credit reports.
Fraud Alerts and Credit Report Locking
Placing a fraud alert on credit reports makes it mandatory for creditors to verify the identity anyone who attempts to open accounts in your name, even if it’s you.
Locking or freezing makes more difficult for anyone to create new accounts in your name. When needed, you can unfreeze or unlock the credit report either permanently or temporarily.
Change When Tax Returns are Filed
By changing when you file your tax returns and filing them early, you can prevent tax identity theft. Then others can’t claim refunds using your information.
Open an E-Verify Account
Setting up an E-Verify account lets you lock your social security number, which makes it impossible for others to use it to apply for employment. Your social security number will not be able be used for any job-related use by others.
Keeping track of expenses and transactions on bank and credit card statements is also critical to ensure no misuse occurs and assists in resolving any fraudulent transactions.
Be careful of emails appearing to be from financial institutions and other entities that can be phishing scams intending to steal credentials or gain personal information. Verify any such emails are legitimate by logging into genuine websites to verify URLs or calling customer service to verify an email was sent. Always look at the sending email for any discrepancies in the domain address.
Additional Personal Security
Additionally, implementing continual and long-term security techniques will help to keep hackers and identity thieves away from personal information.
- Update passwords
- Enable multifactor or two-factor authentication
- Learn more about identity theft
- Report unfamiliar or suspicious activity
However, this breach demonstrates an unprecedented release of private data to the dark web and other sources, posing a serious risk to millions of people. By taking immediate steps to monitor and secure your information, you can protect yourself from any potential fallout from this breach.