Background Check Firm National Public Data Confirms Breach

Background check firm National Public Data is notifying 1.3 million individuals that their personal information was stolen in a December 2023 breach of its systems.

See Also: Effective Communication Is Key to Successful Cybersecurity

The stolen information appears to include an individual’s name, email address, phone number, Social Security number and mailing address or addresses.

Florida-based National Public Data – its official name is Jericho Pictures – is a data aggregator that sells background and criminal record checks, as well as person lookup and verification services, which customers can access via an API. “Our services are currently used by investigators, background check websites, data resellers, mobile apps, applications and more,” its website says.

The company began sending data breach notifications to affected individuals on Aug. 10, saying the breach traced to a Dec. 30 breach it detected the same day.

National Public Data advises individuals whose personal details it harvested and then lost to “closely monitor your financial accounts and if you see any unauthorized activity, you should promptly contact your financial institution,” as well as to regularly review their credit reports and to “place a free fraud alert on your credit file,” which can be renewed annually.

Breached Data Listed in April

The company’s breach notification trails by four months copies of the stolen data being offered for sale.

In April, the researchers behind the vx-underground account on social platform X were among the first to begin reporting on the stolen data. They said it was stolen by a threat actor who uses the handle “SXUL” and listed by a threat actor with the handle “USDoD” on cybercrime marketplace BreachForums on April 8.

The dataset, priced at $3.5 million, contained 2.9 billion rows of data on Americans, USDoD claimed.

Based on its review, vx-underground said the 277.1-gigabyte file listed for sale contained at least some “real and accurate data,” based on several individuals who gave the group permission to check their personal details. Researchers said the dataset included an individual’s address histories for up to three decades or more, and enabled them to discern family relationships, including for individuals’ parents and close siblings, as well as uncles, aunts and cousins and deceased relatives. The dataset didn’t appear to contain any information for individuals who used National Public Data’s opt-out service.

Some media outlets reported that the dataset included information on 2.9 billion Americans. Multiple security experts said this characterization was erroneous on multiple fronts, including because the current population of the U.S. features only about 333 million people. Also, multiple rows in the dataset might reference the same individual.

Vx-underground said the dataset “is structured weird so gives illusion of billions of records – but not quite” and said the dataset also includes “lots of dead people,” including some who have been deceased for up to two decades.

On Aug. 6, the BreachForums user “Fenrich” leaked at least some of the information first offered for sale by user USDoD.

Australian data breach expert Troy Hunt reported receiving a copy of at least some of the leaked data earlier this month and said it contained 134 million unique email addresses and resolved to 2.7 billion rows of data.

When attempting to review the data’s authenticity, he said in a blog post, he discovered that 28 of the rows include his email address, but next to incorrect names, addresses and birthdates. He said it’s not clear from where the information, including the erroneous data, originated.

Hunt runs the free Have I Been Pwned breach notification service, which enables people to see if their email address has appeared in a data breach. He has loaded the 134 million email addresses into HIBP, but he flagged this as an “unverified” breach since “there’s clearly some degree of invalid data in here.”

While the dataset he reviewed included files containing Social Security numbers, he said those specific files contained no email addresses. “If you find yourself in this data breach via HIBP, there’s no evidence your SSN was leaked, and if you’re in the same boat as me, the data next to your record may not even be correct,” he said.

Lawsuit Claims Unjust Enrichment

National Public Data is already facing at least one class action lawsuit over the breach, filed before the company confirmed that it was the source of the stolen information.

On Aug. 1, California resident Christopher Hofmann filed a complaint against National Public Data in the U.S. District Court for the Southern District of Florida. Hofmann said he was notified on July 24 by an identity theft monitoring service provider that his personal information had been found on a dark web site, and that it was compromised from nationalpublicdata.com.

His lawsuit accuses National Public Data of negligence, unjust enrichment and other legal violations, including failing to notify victims by the time he filed his complaint. Hofmann seeks monetary relief and demands that the company purge all affected data, encrypt future collections and implement strict cybersecurity measures, including annual third-party assessments.