National Public Data faced suit over a claimed 2.9 billion record breach
- Organization
- Jerico Pictures Inc. (National Public Data)
- Exploit
- Hacking
- Industry
- Data Brokerage
A proposed class action filed on August 1, 2024 in the U.S. District Court for the Southern District of Florida brought public attention to a claimed breach at Jerico Pictures Inc., which trades as the background check data broker National Public Data. The complaint alleged the company had failed to properly secure personal information it gathered by scraping non public sources.
The underlying claim originated on April 8, 2024, when a threat actor using the handle USDoD advertised a database on a dark web forum, saying it held 2.9 billion records on people in the United States, the United Kingdom and Canada, and offering it for $3.5 million. The advertised fields included full names, current and former addresses going back decades, Social Security numbers and details of relatives.
Reporting on the scale diverged sharply. Security Affairs described roughly 2.9 billion individuals as affected and cited researchers at VX Underground who said a 277.1GB archive they reviewed contained accurate data. SecurityWeek treated the breach as unconfirmed, noting that the combined population of the three countries is under 500 million, that database rows are not the same as people, and that the lawsuit contained factual errors, including identifying USDoD as the intruder when SecurityWeek reported the actual actor used the alias SXUL.
National Public Data had not confirmed the breach publicly or notified the UK's Information Commissioner's Office as of early August 2024.