2.7 billion records stolen from National Public Data published for free on hacker site

About 2.7 billion records of individuals in the United States stolen by a data broker earlier this year have been posted for free on the hacker site Breach Forums, potentially exposing nearly every living American to the data leak.

The data in question was stolen in April by a data broker called National Public Data and offered for sale on breach forums and dark web websites. Now, most of that data has been released for free.

The data is said to contain names, mailing addresses, social security numbers and other additional details in unencrypted format. However, Bleeping Computer reported on Sunday that the free dump did not include phone numbers and email addresses that were included in the original stolen data that was offered for sale earlier this year.

Founded in 2008, Coral Springs, Florida-based National Public Data provides services to companies to conduct background checks on prospective employees and other individuals. The data broker obtains personal information from public and nonpublic databases, court records, state and national databases, and other archives. The data collected by the company often contains sensitive personal information that is used as part of the background screening process.

The April hack of the company was carried out by a criminal group called USDoD, which initially offered the stolen data for sale for $3.5 million. How exactly the data was stolen was never disclosed, but National Public Data is facing four class action lawsuits over the data theft, including one accusing the company of negligence, unjust enrichment and breach of fiduciary duty.

In the past, the theft of 2.7 billion records and their subsequent publication would have caused great shock, but in 2024 this is commonplace.

“This incident is part of a larger, ongoing trend we’ve observed over the past few years,” Paul Laudanski, head of security research at cybersecurity vendor Onapsis Inc., told SiliconANGLE. “The proliferation of sensitive data online has made the internet a lucrative target for cybercriminals. As this trend continues to grow, we can expect to see an increase in data breaches as attackers refine their tactics and exploit emerging vulnerabilities and security holes.”

Laudanski noted that companies need to remain vigilant by, for example, conducting regular security assessments, implementing strong encryption and training their employees to follow security best practices. He added: “While complete prevention is challenging due to the constantly evolving landscape, proactive measures can be taken to significantly reduce the risk of attacks of this magnitude.”

Image: SiliconANGLE/Ideogram