On August 6, hackers leaked almost 2.7B records of people in the US, such as names and SSNs, allegedly from National Public Data, which collects and sells data

Almost 2.7 billion records of personal information for people in the United States were leaked on a hacking forum, exposing names …

BleepingComputer 2024-08-13 Lawrence Abrams

Context & Ripple Effects

The leak put a little-visible part of the data economy—the background-check and data-broker business—under scrutiny because the reported records included durable identity data rather than merely account credentials. Subsequent coverage found that the scale claim required caution, while also reporting that National Public Data confirmed a breach involving sensitive personal information.

The episode later became a business-continuity issue for the broker: [[a:877002|its Chapter 11 filing acknowledged that the incident may affect hundreds of millions of people]]. That progression makes the story relevant beyond the initial hacking-forum post.

First-order effects

People whose names and Social Security numbers appear in the dataset face a lasting exposure risk: those identifiers cannot simply be reset like a password.
National Public Data faces immediate pressure to establish the dataset’s provenance, scope, and affected population while its handling of collected and sold personal data is scrutinized.

Second-order effects

Organizations that use background-check or brokered data may reassess vendor security and provenance controls, particularly where sensitive identifiers are retained or resold.
The public release raises the cost of identity verification and fraud prevention for downstream services, because compromised identity data can make basic knowledge-based checks less reliable.

Third-order effects

If breaches of broker-held identity data continue, the sector may face stronger demands for limits on collection, retention, and onward sale—not just better perimeter security.
The case illustrates a structural mismatch: data brokers can aggregate high-value identity records, while the individuals represented in those records have limited practical control over their circulation.

The trend: This is one data point in the growing push to treat commercially traded personal data as a high-risk asset with obligations closer to those imposed on other critical identity infrastructure.

Discussion

@slickrockweb @slickrockweb on x
This hack and dump on the USdod site appears to be legit and a significant leak of PII including social security numbers. The threat actor USDoD in April claimed to be selling a 4 TB database containing 2.9 billion rows apparently exfiltrated from National Public Data, a public […
@escher911 @escher911 on x
“The worst part is that those impacted by this cyberattack may be unaware of their involvement since National Public Data allegedly collects data from non-public sources without consent.” Good job guys! Now why don't we switch to CDBCs and digital IDs, what could possibly go
@elbartoarmy @elbartoarmy on x
“While BleepingComputer can't confirm if this leak contains the data for every person in the US, numerous people have confirmed to us that it included their and family members' legitimate information, including those who are deceased.” https://www.bleepingcomputer.com/ ...
@keepitwilder @keepitwilder on x
Nearly 3 Billion People ( 1/3 of the world population) Hacked in National Public Data Breach. What You Need to Know This is a company other companies use, and you may not personally have knowledge your data is with them. Nearly three billion individuals had their personal data
@elbartoarmy @elbartoarmy on x
This data was stolen from National Public Data, a company that scrapes up your data and sells it, adding to the pile of reasons why companies shouldn't be allowed to do that.
@hongpong @hongpong on x
none of these companies are going to spend serious money on security smh “The data allegedly comes from National Public Data, a company that collects and sells access to personal data for use in background checks, to obtain criminal records, and for private investigators.”

Chronicles