Key Highlights
- National Public Data, a company specializing in background checks, confirmed a data security incident resulting in a massive exposure of highly sensitive personal information.
- 2.9 Billion Records included Social Security numbers, full names, addresses, phone numbers, and emails were exposed
- Investigation revealed the data was accessed as far back as late December 2023, and offered to sell it for 3.5 Million on the dark web and similar marketplaces
- The incident shines a light onto the chaotic world of data brokers and the fractured supply chains that store various consumer info
- Victims have been advised to consider placing a fraud alert on their credit reports, including freezing or “locking” them through the major credit bureaus
Introduction
It was a dangerous combination for National Public Data and Background Checks to be tied together into a single service. Recently, a very massive data breach has compromised the sensitive personal data of millions on a level that has alarmed most people in the US.
National Public Data, a Florida-based company dealing with background check data aggregation, stands at the center of the breach where it has exposed Social Security numbers, emails, names, and other personal information. This breach highlights the vulnerability of public data amidst increasing cybersecurity threats, raising concerns about identity theft and fraud.
However, the often overlooked topic of criminal records data and the interlocking worlds of publicly available information must be addressed when fighting for consumer privacy. Researchers at RecordFixer have monitored this world for eight years now, and we predict the road ahead will only get bumpier.
The Unspoken Secret about “public” Consumer Data
The National Public Data breach underscores a concerning reality: the vast and largely unregulated world of data brokers goes far beyond credit cards, addresses, mugshots, and phone numbers.
Large networks of loosely organized businesses operate in an opaque world where anything and everything about you can be gathered and repurposed. Ranging from arrest records, social media profiles, addresses, court filings, divorces, restraining orders, credit disputes, and dating profiles, any activity can be stored and sold from the digital footprints we leave. By amassing massive datasets on individuals, often without the knowledge or consent of anyone in the public, supply chains converge in order to fight for more market share.
This complex world of aggregation sells billions of rows of data daily to all segments of enterprises and individuals, including all types of markets/industries, savvy marketers, government agencies, and sometimes shadowy organizations.
That doesn’t sound so secret. Why is this different?
Question: What on earth is a background check company gathering people’s emails and Social Security Numbers for???
Answer: The public has been misled as to what a “background check” is really supposed to be.
Background checks are defined under US law as pre-screening activities that allow employers, credit bureaus, housing providers, and other authorized persons to conduct judgment based decisions when using consumer information. If you don’t have a permissible purpose to look up a person’s criminal history, guess what?: You are not authorized to look it up through a third party. And those third parties cannot sell that information to anyone they want.
But this flies in the face of anyone who has ever searched for “records” on any person or business. We are bombarded with “Look up anyone” websites and People Search engines that promise the largest databases so that you can do your “research”. This obviously can go too far. But how did it take us to this point?
Curiosity.
People… (i.e., ex-lovers, neighbors, business rivals, celebrity stalkers, etc.) have a huge appetite for other people’s information. And businesses are happy to make that service available for a one-time fee or a once a month subscription. If you have EVER googled someone other than yourself, you already know what that means.
What this all comes down to is this: the vast majority of private consumer data (DOBs, SSNs, addresses, marriage certificates, income, assets, etc.) sits in very unstructured databases that have nothing to do with each other. But if one company can buy it from another as accessory datasets, then what’s to stop them from hoarding it to beef up their business models?
Agencies and Courts are Still a Treasure Trove, but Administrators are Working on it
The Joint Technology Committee of the National Center for State Courts (NCSC) has advocated for years (since 2018) on tackling the best practices of safeguarding individual privacy while balancing the interests of the justice system. Within weeks of GDPR passing, the NCSC and sister organizations were alerted that similar legislation in the US may come our way and they assigned some pretty smart people to get ready for it.
However, that legislation didn’t really make its way through.
Understanding the SSN Breach and Its Implications
The National Public Data breach has raised serious concerns about the security of private information as well as the heightened exposure to identity theft and fraud.
The breach potentially affects millions of individuals whose sensitive data, including Social Security numbers, might now be in the hands of malicious actors. Even more importantly, the records can now be repurposed for all sorts of nefarious reasons for years to come.
Although a relatively small company, operating under an entity named Jerico Pictures, it shows how a single business in Coral Springs can expose millions of people’s private information when enough sources are aggregated.
Prompt action, such as monitoring financial transactions and credit reports, is crucial for those potentially affected by this breach. It underscores the need for individuals to be proactive in safeguarding their personal information and for companies to prioritize data security measures to prevent such incidents.
How the SSN Breach Happened and Why you are at Risk
To get a very in-depth analysis of where all the pieces fit together, we cannot recommend more highly the amazing work that KrebsOnSecurity has already done on this topic. But here’s a brief rundown using publicly available reports.
Bloomberg Law initially reported the breach through a class-action lawsuit filed against National Public Data (NPD). While investigations are still ongoing, the company attributes the data security incident to a “third-party bad actor” attempting to gain unauthorized access to their systems. Krebs reported that the company inadvertently published their own passwords to its backend database. This incident underscores the sensitive links between and within vendors that allow “supply chain” cyberattacks. In this case, a .zip file was embedded on the recordscheck.net website (built by the same overseas website developer) with administrator passwords. It should be noted that recordscheck.net (formerly recordscheck.info) offered “instant background checks”–typically a red flag in the employment screening industry given the compliance guidelines that regulate consumer reporting agencies which prohibit services that do not have built-in procedures to ensure accuracy. Which is why prolific consumer advocates like Chi Chi Wu and Ariel Nelson of the National Consumer Law Center (NCLC) have consistently stressed the importance of expanding consumer statutes to include data broker actions under the authority of the Fair Credit Reporting Act (FCRA).
While the company claims to have implemented additional security measures, the potential leaks are believed to have transpired throughout 2024, leaving individuals vulnerable for an extended period. The breach remained undetected for such a significant duration, that it’s difficult to conclude how many of the 137 million emails and 272 million SSNs have already become targets of cyber campaigns.
The exposure of this data places individuals at severe risk of countless fraudulent activities. Malicious actors can exploit this stolen information to impersonate victims, open fraudulent accounts, and gain access to existing financial accounts.
The potential consequences can be devastating and cannot be overstated; leading to financial losses, damaged credit scores, and a long road to recovery for those affected.
What this ultimately means is that combining National Public Data and Background Checks services were a potent mix for privacy violations.
How Data Removal Works & How You can Benefit
There are measures to minimize further exposure and potential harm. It starts with understanding which data broker platforms hold your information and utilizing their opt-out options to reduce your digital footprint.
Additionally, following a breach like the one experienced by National Public Data, taking proactive steps becomes vital.
Monitoring your financial accounts for any unauthorized activity, reviewing your credit reports regularly, and potentially freezing your credit can significantly reduce the risk of identity theft. Implementing additional security measures, like enabling two-factor authentication and creating strong, unique passwords, can further fortify your defenses against cyber threats.
For those with criminal records, it is strongly advised that any past arrests that were not charged seek court orders to seal. Similarly, for anyone who has benefited from dismissed or diverted cases, one should keep multiple copies of the Court Order granting expungement and similar post-conviction relief. RecordFixer built the first and only automated platform to remove criminal records from background check databases using best-in-class methods to achieve real privacy.
It starts with your Email
Many would be surprised how much information can be accessed through a single email account. Infosec professional and law enforcement agencies work tirelessly to investigate hundreds of thousands of cyberattack cases that begin with unauthorized email account access. When using breach lookup tools such as the ones we recommend below, it pays to notice that inputing one’s email is virtually the first step each and every time.
Conclusion
In conclusion, safeguarding your personal data is crucial in today’s digital age, especially with the prevalence of SSN breaches and public data exposure. Take proactive steps to protect your information and consider data removal services to enhance your privacy. Stay informed about potential breaches and be prepared to act swiftly if your SSN is compromised. Your data security is paramount, so prioritize measures that can mitigate risks and ensure your peace of mind. Be vigilant, informed, and proactive in safeguarding your sensitive information from unauthorized access.
Frequently Asked Questions
Recognizing that the reader may have multiple questions on a topic that crosses over with so many other subject matters, the following are some short guidelines for anyone wanting to learn more. National Public Data and Background Checks covers large overlaps in consumer rights, data privacy, and attack surface exposure.
How do I check if my SSN has been compromised?
Some incredible work has already been done by NPD.Pentester.com. You can visit their site to validate some of your information and get a very quick result on where you fall in the exposed records. We also recommend the juggernaut of security breach lookups haveibeenpwned.com.
The website is called “Pentester”? Should I be concerned?
No. Cyber security professionals and researchers in the infosec community build all kinds of tools that inform consumers without charge. This particular site has stood out from many others and rather quickly made available what would normally take some sophisticated tool work to confirm if you’ve been affected by the National Public Data (NPD) breach.
What steps should I take if my SSN is involved in a breach?
As some of the researchers like Krebs recommends, you may want to consider “freezing” your credit files (sometimes akin to “Locking” it). You can obtain a free credit report from each of the three major credit bureaus (Equifax, Experian, and TransUnion) at annualcreditreport.com. Additionally, consider placing a fraud alert on your credit file with each bureau to flag suspicious activity.
Contact your financial institutions immediately, monitor your financial accounts for unauthorized activity, and place a fraud alert on your credit file. Filing a police report and consulting with a lawyer about the class action lawsuit are also advised.
Do I have to contact Transunion, Experian, and Equifax separately?
Unfortunately, there is no one-shot-solution. Each agency operates on their own and it’s best to register with the “Big-3” credit bureaus to effectively freeze (or “lock”) your files.
Are National Public Data and background checks services allowed to access my SSN without consent?
Background checks for employment or other purposes often require consent to access sensitive personal information like your Social Security number. But there is a very important distinction when talking about traditional (compliant) screening versus open gate people search profiles. Since NPD offered “instant” results to what appears to be non-authorized uses, they may have to face serious questions by regulatory authorities if these were compliant activities.
Educating yourself and exploring where your information may be sitting is a long journey which we recommend you begin practicing on a regular basis. If you found this article, you’re already on the right path.
