The National Public Data breach, explained

A background-check site you never signed up to may have held your Social Security number, and a criminal sold its data. What leaked, what the company said, how the numbers don't agree, and what to do today.

HARD JournalPrivate cybersecurity · 7 min read

National Public Data was a US background-check website that sold access to personal records, and most of the people in its files had never heard of it. In April 2024 a criminal put a copy of its data up for sale, and in August a version was posted for free. It was reported as 2.9 billion rows of records, Social Security numbers among them. The company first told regulators that 1.3 million people were affected, then filed for bankruptcy in October 2024. If you've ever lived in the US, or are related to someone who has, you may be affected even though you never used the site, so it is worth taking the precautions below.

What happened, and when

How they got in

We don't know, and neither does the public record. NPD described "a third-party bad actor" trying to get into its data in December 2023, and said nothing more about the method. Reporting names two criminals: one using the handle SXUL, who is said to have taken the data, and USDoD, who sold it. We've found no regulator or court that has established how the intruder got in, so we won't guess.

What matters for you is simpler. NPD wasn't a company you chose. Brokers like it buy and scrape records, merge them and sell them, and the person in the file has no account to protect and no one to call.

You can't secure an account you didn't know existed.

What was taken, and who was affected

NPD's notification letters said the stolen data included name, email address, phone number, Social Security number and mailing addresses. The counts disagree, and the differences are worth understanding.

• 2.9 billion rows. This is rows, not people. The same person appears many times, once for each address they've had.
• About 270 million people. The seller's claim, repeated widely in the press.
• 134 million unique email addresses. Troy Hunt found these in the files he examined. He also found that the Social Security number files held no email addresses. Applying the share of unique Social Security numbers in a 100-million-row sample to the claimed 2.9 billion rows, he estimated about 899 million distinct values. That is an estimate, and it doesn't show how many were valid or how many people were affected.
• 1.3 million people. NPD's own figure to regulators. Its bankruptcy filing later said it was likely liable to notify and pay for credit monitoring for "hundreds of millions of potentially impacted individuals".

Hunt also warned that the data is often wrong. His own email address appeared in 28 rows with the wrong personal details, including birth years that weren't his. Some records pair real email addresses with incorrect personal details. Where a real Social Security number sits next to a real name, a thief can use it, and your family members may be in the file even if you aren't.

Because it is a broker's file, the data covers people in the US and, according to reports, some in Canada and the UK. Australians who have lived or worked in the US, or who are related to someone who has, can be in it too.

What the company and the courts did

• NPD: began sending notification letters on 12 August 2024, according to reporting, and filed notices with state regulators. The original site went offline. Reports say a site using the National Public Data name later came back as a people-search service with an opt-out form, under a different owner.
• Courts: the lawsuits started in August 2024. The October 2024 bankruptcy filing froze most of them and said the company's assets were worth a tiny fraction of the liabilities. The California Privacy Protection Agency later said the bankruptcy petition was dismissed. We haven't found a settlement or ruling that pays affected people, and a person can't count on one.
• Regulators: press reports at the time of the filing said the FTC and more than 20 states were looking at the company. In May 2025 the California Privacy Protection Agency ordered the company to pay a US$46,000 fine. The fine was for registering as a data broker 230 days late under California's Delete Act, not for the breach, and it paid nothing to affected people.

Why it still matters for a household or an executive

A Social Security number is the one piece of data that you can't change at will. The file also gave a current mailing address and phone number for many people, plus the addresses of their past homes, which are the answers to many "security questions". A criminal doesn't need to hack you after that. They can open a credit line, file a false tax return, or phone your bank or your mobile carrier and sound like you.

For an executive or a family with a public profile, the risk is the follow-on contact. A caller who knows your Social Security number, your old address and your relatives is much more believable, and the data remains available because it has been copied many times over.

What to do today

1. Freeze your credit.If you're in the US or have a US file, freeze it at Equifax, Experian and TransUnion. It's free, doesn't affect your score, and blocks most new accounts. Do it for children too, and for older relatives, who are the usual targets. Elsewhere, ask your national credit bureau for the equivalent.
2. Get an Identity Protection PIN.In the US, the IRS offers one to anyone, free. It stops someone filing a tax return in your name with your number.
3. Lock your phone number to you.Ask your carrier for a number lock or port-out protection and a long passcode that isn't a birthday. With a name, address and number, a SIM swap is a short phone call, and your text codes go to the thief.
4. Move codes off text.Use an authenticator app or a passkey for email, banking and any app that holds money. Email first, because it resets everything else.
5. Use a different password everywhere.A password manager makes this easy. Check your email address at haveibeenpwned.com, which loaded this data, to see where else you've been exposed.
6. Expect the follow-on scams.Calls from a "fraud department" that quote your old address, texts about a suspicious login, and offers to "help you claim compensation". If someone calls you, hang up and ring the number on your card. No one legitimate asks you to pay to claim.
7. Watch your credit report.US residents can get free reports from all three bureaus at annualcreditreport.com. Look for accounts and inquiries you don't recognise. If one appears, report it at identitytheft.gov.
8. Ask the brokers to remove you.Many people-search sites have an opt-out form, including the relaunched National Public Data. It removes a listing, not the data already copied, so treat it as housekeeping and not as a fix.

None of this is hard, but it is a lot of small jobs across several people, and brokers re-list you over time. Doing it once, properly, for a whole household is part of what private cybersecurity is for. Our essay explains why the companies that hold your data are a way in. The AT&T breaches are the same story from a company you did choose.

Sources