NewsCompaniesFlawsGuides
Get the app

The National Public Data breach, explained

A long read from HARD News · · 7 min read
This article is about the 2024 breach of the data broker. For the site later relaunched under the same name, see What the company and the courts did.

A background-check site you never signed up to may have held your Social Security number, and a criminal sold its data. What leaked, what the company said, how the numbers don't agree, and what to do today.

National Public Data was a US background-check website that sold access to personal records, and most of the people in its files had never heard of it. In April 2024 a criminal put a copy of its data up for sale, and in August a version was posted for free. It was reported as 2.9 billion rows of records, Social Security numbers among them. The company first told regulators that 1.3 million people were affected, then filed for bankruptcy in October 2024. If you've ever lived in the US, or are related to someone who has, you may be affected even though you never used the site, so it is worth taking the precautions below.

What happened, and when

WhenWhat happened
December 2023According to NPD, a third party tried to hack into its data in late December. Its notice gives the date as 30 December 2023.[4]
8 April 2024A criminal using the name USDoD offers a 277 GB data set on a hacking forum, claiming 2.9 billion records on about 270 million people, for US$3.5 million.[4]
1 August 2024The first federal class action, Hofmann v. Jerico Pictures, is filed in the Southern District of Florida. More follow.[5]
6 August 2024A forum user called Fenice posts a version of the data for free, according to Troy Hunt. This is the point at which most people heard of it.[1]
Mid-August 2024NPD begins sending notices and files with the Maine Attorney General, saying 1.3 million people were affected. Sources give 16 and 17 August for the filing.[2]
October 2024Jerico Pictures files for Chapter 11 bankruptcy in Florida. Press reports of the filing put its bank balance at US$33,105 and say it faced more than a dozen lawsuits and scrutiny from the US Federal Trade Commission and more than 20 states.[3]
February 2025The California Privacy Protection Agency files an enforcement action against the company. Its announcement says the bankruptcy petition was dismissed.[7]
May 2025The agency orders the company to pay a US$46,000 fine.[8]

How they got in

We don't know, and neither does the public record. NPD described "a third-party bad actor" trying to get into its data in December 2023, and said nothing more about the method. Reporting names two criminals: one using the handle SXUL, who is said to have taken the data, and USDoD, who sold it. We've found no regulator or court that has established how the intruder got in, so we won't guess.

What matters for you is simpler. NPD wasn't a company you chose. Brokers like it buy and scrape records, merge them and sell them, and the person in the file has no account to protect and no one to call.

You can't secure an account you didn't know existed.

What was taken, and who was affected

NPD's notification letters said the stolen data included name, email address, phone number, Social Security number and mailing addresses.[6] The counts disagree, and the differences are worth understanding.

  • 2.9 billion rows. This is rows, not people. The same person appears many times, once for each address they've had.
  • About 270 million people. The seller's claim, repeated widely in the press.
  • 134 million unique email addresses. Troy Hunt found these in the files he examined. He also found that the Social Security number files held no email addresses.[1] Applying the share of unique Social Security numbers in a 100-million-row sample to the claimed 2.9 billion rows, he estimated about 899 million distinct values. That is an estimate, and it doesn't show how many were valid or how many people were affected.
  • 1.3 million people. NPD's own figure to regulators.[2] Its bankruptcy filing later said it was likely liable to notify and pay for credit monitoring for "hundreds of millions of potentially impacted individuals".[3]

Hunt also warned that the data is often wrong. His own email address appeared in 28 rows with the wrong personal details, including birth years that weren't his.[1] Some records pair real email addresses with incorrect personal details. Where a real Social Security number sits next to a real name, a thief can use it, and your family members may be in the file even if you aren't.

Because it is a broker's file, the data covers people in the US and, according to reports, some in Canada and the UK. Australians who have lived or worked in the US, or who are related to someone who has, can be in it too.

What the company and the courts did

  • NPD: began sending notification letters on 12 August 2024, according to reporting, and filed notices with state regulators.[6] The original site went offline. Reports say a site using the National Public Data name later came back as a people-search service with an opt-out form, under a different owner.[5]
  • Courts: the lawsuits started in August 2024. The October 2024 bankruptcy filing froze most of them and said the company's assets were worth a tiny fraction of the liabilities. The California Privacy Protection Agency later said the bankruptcy petition was dismissed. We haven't found a settlement or ruling that pays affected people, and a person can't count on one.
  • Regulators: press reports at the time of the filing said the FTC and more than 20 states were looking at the company. In May 2025 the California Privacy Protection Agency ordered the company to pay a US$46,000 fine. The fine was for registering as a data broker 230 days late under California's Delete Act, not for the breach, and it paid nothing to affected people.[8]

Why it still matters for a household or an executive

A Social Security number is the one piece of data that you can't change at will. The file also gave a current mailing address and phone number for many people, plus the addresses of their past homes, which are the answers to many "security questions". A criminal doesn't need to hack you after that. They can open a credit line, file a false tax return, or phone your bank or your mobile carrier and sound like you.

For an executive or a family with a public profile, the risk is the follow-on contact. A caller who knows your Social Security number, your old address and your relatives is much more believable, and the data remains available because it has been copied many times over.

What to do today

  1. Freeze your credit.If you're in the US or have a US file, freeze it at Equifax, Experian and TransUnion. It's free, doesn't affect your score, and blocks most new accounts. Do it for children too, and for older relatives, who are the usual targets. Elsewhere, ask your national credit bureau for the equivalent.
  2. Get an Identity Protection PIN.In the US, the IRS offers one to anyone, free. It stops someone filing a tax return in your name with your number.
  3. Lock your phone number to you.Ask your carrier for a number lock or port-out protection and a long passcode that isn't a birthday. With a name, address and number, a SIM swap is a short phone call, and your text codes go to the thief.
  4. Move codes off text.Use an authenticator app or a passkey for email, banking and any app that holds money. Email first, because it resets everything else.
  5. Use a different password everywhere.A password manager makes this easy. Check your email address at haveibeenpwned.com, which loaded this data, to see where else you've been exposed.
  6. Expect the follow-on scams.Calls from a "fraud department" that quote your old address, texts about a suspicious login, and offers to "help you claim compensation". If someone calls you, hang up and ring the number on your card. No one legitimate asks you to pay to claim.
  7. Watch your credit report.US residents can get free reports from all three bureaus at annualcreditreport.com. Look for accounts and inquiries you don't recognise. If one appears, report it at identitytheft.gov.
  8. Ask the brokers to remove you.Many people-search sites have an opt-out form, including the relaunched National Public Data. It removes a listing, not the data already copied, so treat it as housekeeping and not as a fix.

None of this is hard, but it is a lot of small jobs across several people, and brokers re-list you over time. Doing it once, properly, for a whole household is part of what private cybersecurity is for. Our essay explains why the companies that hold your data are a way in. The AT&T breaches are the same story from a company you did choose.

See also

References

  1. ^ Troy Hunt. “Inside the "3 Billion People" National Public Data Breach”, Aug 2024.Troy Hunt's analysis: 134 million email addresses, what the files held, and the data-quality problems.
  2. ^ The Register. “National Public Data breach: the numbers don't add up”, Aug 2024.NPD's Maine filing and the 1.3 million figure, set against the researchers' counts.
  3. ^ The Register. “National Public Data's parent files for bankruptcy”, Oct 2024.The Chapter 11 filing, the company's finances and the "hundreds of millions" statement.
  4. ^ ITPro. “The National Public Data breach and the bankruptcy”, Oct 2024.The April 2024 listing, NPD's account of December 2023 and the lawsuits.
  5. ^ Hackread. “National Public Data relaunches despite the breach”, Aug 2025.The relaunched site and the first federal lawsuit, Hofmann v. Jerico Pictures.
  6. ^ Cyber Daily. “National Public Data starts notifying victims”, Aug 2024.The notification letters, the Maine filing and the data NPD said was taken.
  7. ^ California Privacy Protection Agency. “CPPA action against National Public Data”, Feb 2025.The enforcement action over late data-broker registration, and the dismissed bankruptcy petition.
  8. ^ California Privacy Protection Agency. “CPPA orders Florida data broker to pay fine”, May 2025.The US$46,000 fine, issued separately from the breach.

Checked against the sources. Sources disagree on the date NPD filed with Maine (16 or 17 August 2024) and on when the data first spread. We use the April listing and the 6 August free release from Troy Hunt. The 2.9 billion and 270 million figures are the seller's and press claims, not confirmed by NPD. We haven't seen the court filings ourselves, so the bankruptcy details are as reported by the press.