Anatomy of a Breach: National Public Data — 2.9 Billion Records Including Social Security Numbers from a Data Broker You Never Heard Of

2.9 billion records. SSNs. From a company you never heard of. That had your data anyway.

In August 2024, approximately 2.9 billion records were posted on a hacking forum — stolen from National Public Data (NPD), a Florida-based company operating in the background check and people-search industry. The leaked data included names, addresses, Social Security numbers, dates of birth, and phone numbers for hundreds of millions of individuals, primarily in the United States but also including records from the UK, Canada, and other countries.

NPD had acquired the data through scraping publicly available records, aggregating data from multiple sources, and compiling comprehensive personal profiles — all without the knowledge or consent of the individuals whose data it held. Most affected individuals had never heard of National Public Data, never interacted with the company, and had no idea it held their Social Security numbers. The breach exposed the fundamental privacy problem of the data broker industry: companies you have never heard of hold your most sensitive data, acquired without your consent, and secured to whatever standard they choose. NPD's parent company, Jerico Pictures, filed for bankruptcy shortly after the breach.

Companies you never consented to hold data you never knew they had.

Data brokers hold the data. When they are breached, everyone is affected.

The NPD breach demonstrated the systemic risk of the data broker industry: companies holding population-scale data, acquired without consent, with security standards that may be inadequate — and whose breach affects hundreds of millions of people who never knew the company existed. For UK organisations that use background check services, data enrichment providers, or people-search tools, the security of those providers is part of your risk surface. Cyber Essentials addresses data processing security. Our penetration testing assesses third-party data provider security. SOC in a Box monitors for credential and data exposure. And UK Cyber Defence provides incident response when third-party breaches affect your organisation.

Related Articles