National Public Data Breach exposes 2.9 billion

Updated October 2026: We added what happened after the National Public Data breach, including the company’s bankruptcy and the arrest of the suspected hacker, plus current steps to protect your identity.

Embed from Getty Images

A class action lawsuit against Jerico Pictures Inc. (DBA National Public Data), a background-check company, was filed at the beginning of August due to a data breach. The breach exposed data of approximately 2.9 billion people in April with no specific date pinpointed or information on how the breach happened.

Personal data including full names, former and present addresses going back as far as 30 years, Social Security Numbers, and more was acquired by a cybercriminal group, USDoD. The hackers then tried to sell the data on the dark web for $3.5 million.

National Public Data obtained personal background-check information by scraping, a technique to collect data from websites and other online sources. It’s also been identified that the company scraped personal information from non-public sources as well.

National Public Data has not provided notice or warning to those that have had their information shared. One of the 2.9 billion people affected found out about the breach by a notification from his identify theft service.

Typically after a breach of this size, the company notifies the people affected and offers free access to identity theft protection or credit monitoring for up to two years. This has not be offered at this time from National Public Data. However, with the class action suit filed, it may become available.

If you think you were included in this breach here are some steps to take in the meantime:

• Be careful when checking your email not to fall for phishing attacks. Always check that the sender is genuine and do not click on suspicious links.
• Monitor your bank accounts and other financial accounts for suspicious activity.
• If you do not have one yet, get a identity theft account.

If you have questions or concerns about cybersecurity and would like some more information, contact us now: https://evernetco.com/call/directory/

Information gathered from: https://news.bloomberglaw.com/privacy-and-data-security/background-check-data-of-3-billion-stolen-in-breach-suit-says

What happened next

Two details in the original report changed as more became known. The 2.9 billion figure counts records, not people, and the files contain many duplicates. Security researcher Troy Hunt found about 899 million unique Social Security numbers in the leaked data. The breach itself dates to late December 2023. April 2024 is when the stolen database first appeared for sale, and copies spread widely that summer, according to The Record’s coverage of the company’s bankruptcy filing.

On October 2, 2024, National Public Data’s parent company, Jerico Pictures, filed for Chapter 11 bankruptcy in the U.S. Bankruptcy Court for the Southern District of Florida. The filing listed about $44,625 in assets. It cited investigations by the FBI, the FTC and state attorneys general. It also said the cost of notifying people and paying for credit monitoring was more than the company could handle. That makes the free monitoring this article hoped the class action might produce unlikely.

On October 16, 2024, Brazil’s Federal Police arrested a 33-year-old man in Belo Horizonte believed to be USDoD, the actor who sold the data. He was also linked to a leak of FBI InfraGard member data, as BleepingComputer reported on the arrest. The arrest does not remove the data from circulation. Treat your name, address history and Social Security number as already exposed.

What to do now

• Freeze your credit with Equifax, Experian and TransUnion. A freeze is free and blocks new accounts opened in your name.
• Request an IRS Identity Protection PIN so no one else can file a tax return with your Social Security number.
• Be suspicious of calls, texts and emails that quote your address or part of your Social Security number. Leaked data makes these scams more convincing.
• Turn on multi-factor authentication for email, banking and any system that holds client data.
• Have staff confirm payment or wire requests by phone, using a number you already have on file.

To check how exposed your business is, see our cybersecurity services and security awareness training.