What happened?
In August 2024, a breach at National Public Data – a background-check data aggregator few consumers had ever heard of – surfaced 2.9 billion rows of personal records, including hundreds of millions of Social Security numbers. The data had been offered on criminal forums for weeks; then a lawsuit filed against the company made the incident impossible to ignore. When this post publishes on 7 August 2024, NPD has confirmed a breach investigation, researchers are probing a leaked 277GB dataset, and the question dominating every FAQ is the quietly brutal one: what does it mean that a company you never chose just decided your SSN is now public?
Quick Answer: National Public Data, a Florida-based background-check and data-brokering firm, suffered a breach that exposed roughly 2.9 billion records – names, addresses, relatives, and in many rows Social Security numbers – covering potentially every adult in the United States and some people in the UK and Canada. Stolen data appeared for sale in April 2024, was given away free by a third party in August, and triggered a class-action lawsuit on 1 August. The company confirmed it was investigating. Practical upshot: assume your SSN, birthdate, and address history are in criminal hands; the defense is credit freezes at all three bureaus, not breach-monitoring subscriptions.
The scale claim that made headlines – “2.9 billion records” – needs translation, because the number is rows, not people. NPD’s dataset was built from aggregating public records, genealogy data, criminal-record checks, and other brokers’ inventories; a single human generates many rows across decades and addresses. Even conservatively deduplicated, the coverage was effectively total: security researchers sampling the data found their own records, their relatives, and long-deceased individuals. The UK and Canadian presence came as a surprise bonus – a reminder that data brokers’ inventories respect no borders because their supply chains do not.
The slow-motion disclosure
The timeline was a study in how breaches actually surface. April 2024: a cybercriminal named USDoD offers “NPD” data for sale on a forum – 2.9 billion rows, priced for serious buyers. Weeks pass; a subset leaks; researchers begin quietly verifying. Early August: an unrelated party posts the full 277GB trove free on an English-language hacking forum, which detonates the story – free beats expensive for news value. 1 August: a class-action lawsuit is filed in Florida federal court by a plaintiff whose SSN appeared in the dump. Only then does NPD post a bare-bones acknowledgment: a breach “likely involved a third-party bad actor,” possibly by “leaking backdoor access,” with the classic reassurance that the stolen data “could include” name, address, SSN, and relatives. No date of initial compromise, no scope count, no attribution beyond suspicion – a disclosure shaped more by lawyers than by forensics.
The paper trail
| Date | Event |
|---|---|
| 2023 (undisclosed) | Alleged initial compromise of National Public Data systems; threat actor later claims access via an information-stealer-infected third party |
| 2024-04 | USDoD offers the 2.9-billion-row NPD dataset for sale on a criminal forum at four-figure pricing |
| 2024-08-01 | Class-action lawsuit filed against Jerico Pictures / National Public Data in US federal court over the exposure |
| 2024-08-06 | Full 277GB dataset posted free on a hacking forum; NPD posts public breach acknowledgment the same day; media coverage explodes |
| 2024-08-07 | This post publishes amid the first wave of defender guides and lookup-tool caution |
| 2024-08→09 | Lookup tools let individuals check exposure; credit-freeze demand spikes; congressional scrutiny of the data-broker industry intensifies |
Why the SSN cannot be a secret anymore
The uncomfortable core of the story is architectural. The Social Security number was never designed as an authenticator – it is an account number from a 1936 retirement program that private industry adopted as a shared secret because it was universal and cheap. Every breach of this scale converts more of the shared-secret stock into public knowledge, and NPD was effectively a bulk converter: it aggregated SSN-linked records from sources that were never individually consented to and sold access by subscription. After August 2024, the honest threat model treats name-plus-SSN-plus-birthdate as adversary-known. Knowledge-based authentication, SSN-based identity verification, and even the legacy credit-header system all inherit that weakness – the breach did not create the dependency on SSNs, it just priced it in public.
What actually helps now
Guidance converged fast because the situation was binary. Credit freezes at Equifax, Experian, and TransUnion are the single highest-value action – free under federal law, and they block new-account issuance rather than merely notifying you afterward. Fraud alerts help less; monitoring services help least, since they detect rather than prevent. IRS Identity Protection PINs close the tax-refund lane specifically. Beyond that: expect phishing that weaponizes the breach itself (fake “check if you were leaked” sites harvested precisely this fear), and treat any knowledge-based verification prompt as compromised-by-design. For organizations, the lesson is to eject SSN from verification flows entirely – the identifier is now, and permanently, public infrastructure.
- Assume exposure: with 2.9 billion rows in the wild, individual caution about “was I in it” is wasted motion; act as if yes.
- Freeze, do not just watch: credit freezes at all three bureaus prevent new-account fraud; monitoring only reports it after the fact.
- KBA is dead: any authentication flow that asks questions answerable from broker data must be retired, not patched.
- Data brokers are unregulated critical infrastructure: nobody chose NPD, yet it held effectively everyone’s dossier – that asymmetry is the policy story.
FAQ
Was this 2.9 billion people?
No – 2.9 billion is rows, not individuals. The dataset contained multiple records per person across addresses, names, and household relationships, plus records for deceased individuals and non-US residents. Deduplicated estimates still put unique-person coverage in the hundreds of millions, plausibly approaching every US adult – which is why the practical advice does not depend on the precise count.
Should I use those websites that check if my SSN was leaked?
Treat third-party lookup tools with suspicion. A few reputable researchers built verifiers that accept a partial SSN and return only presence information – but the moment the story broke, copycat sites appeared that harvest exactly the data people came to check. The safe posture: skip the lookups, go straight to freezes at the bureaus’ own domains. There is no action the lookup result should change.
Does the breach affect people outside the US?
Yes – records for individuals in the UK and Canada appeared in the dataset, likely via data supply chains that cross borders invisibly. Non-US readers face a harder version of the problem: their national identifiers are less central to credit issuance, but cross-border brokers still aggregate and resell their profiles. The structural lesson – a company you never chose holds a dossier on you – is universal.
Legacy: the breach that ended pretending
NPD was not the first mass SSN exposure, and security engineers had declared the SSN dead as a secret many times before 2024. What changed was the pretense. After August, organizations could no longer reasonably claim that SSN-based verification protects anything – the aggregate stock of the “secret” was public, free, and searchable. The breach became a standard citation in the push for digital-identity schemes not rooted in the 1936 numbering system, and a forcing function for enterprises still storing SSNs without a deliberate purpose. The quiet verdict among defenders: National Public Data did not breach your trust, because you never gave it any – and that is precisely the problem legislation now has to solve.
