In April 2024, the National Public Data (NPD) experienced a significant cybersecurity incident known as the NPD breach. This breach compromised the personal data of approximately 2.9 billion individuals, including sensitive information such as Social Security numbers, addresses and email addresses. The cybercriminal group “USDoD” has claimed responsibility for this attack.
NPD confirmed the breach in August 2024, although evidence suggests the initial intrusion occurred in December 2023. In the wake of this incident, NPD has been actively working to secure its systems and address the impact of the breach. Most recently, it was discovered that NPD had inadvertently published its own passwords online, exacerbating the security issues.
Experts from Protegrity, Securin and Traceable have weighed in with their thoughts on the latest news.
Clyde Williamson, Product Management, Innovations, Protegrity
“Organizations rely on the exchange of data for their vitality. Consumers share their personal identifiable information (PII), like Social Security numbers and emails, with the expectation that businesses will protect this data and comply with privacy laws to prevent unauthorized access. In this case, National Public Data (NPD) scraped individuals’ PII from public sources for use in background checks, leaving people unaware if their data was accessed and emphasizing growing concerns regarding customer trust in businesses and their ability to secure their data.
Notably, this breach wasn’t announced for a week; it only came to light and led to a lawsuit earlier because the company didn’t disclose it. Further, it’s still unclear whether they intentionally avoided sharing details of this breach or just discovered it themselves. This highlights the inadequacy of U.S. laws in handling citizens’ personal data, which are not equipped for the challenges of the 21st century. Data brokers like the NPD also aren’t held to the same regulatory standards as institutions like the Payment Card Industry (PCI), where they’re obligated to conduct annual audits and controls around credit card data. As things stand now, the US has no such obligations.
Most likely, a lot of the stolen data set is from one of our most vulnerable demographics: senior citizens and their families. A popular scam has a threat actor pretending to be a lawyer with bad news for the senior – their family member is in trouble and needs money. And why wouldn’t a grandparent believe them if they had valid PII to validate their credibility? These scammers don’t have to open credit in someone’s name to ruin lives. They just need to know how to use the information stolen to empty a caring family member’s bank account.
As breaches and attack surfaces continue to grow, relying on class action lawsuits for negligence cannot be the best option. Organizations must prioritize transparency and enhance their efforts to de-identify sensitive data to protect consumer information. They must move beyond traditional defense mechanisms and adopt regulator-recommended data protection strategies like encryption and tokenization. These methods render data useless to attackers, making it impossible to steal and use maliciously. By implementing these protections, businesses can diminish the value of stolen data and mitigate the long-term effects of ransomware attacks or fraudulent activities.”
Kiran Chinnagangannagari, Chief Product & Technology Officer, Securin
“In the wake of the staggering National Public Data breach, which compromised millions of records on U.S. citizens, the silence from the company until the breach included leaked social security numbers is nothing short of alarming. This breach underscores the profound risks posed by mass data aggregation and sheds a harsh light on the glaring gaps in corporate responsibility when managing and communicating such incidents. The fact that such enormous volumes of personal data are accessible to companies and private investigators, and now the deep and dark web, raises severe doubts about how well-protected our information truly is. This breach lays bare the minimal oversight over who gains access to this data—and what happens afterward.
This breach should also serve as a wake-up call, emphasizing the critical need for organizations to rigorous or stricter regulations and better enforcement. Companies must be held accountable, not just for evaluating the cybersecurity practices of their partners and third-party vendors. It’s no longer enough to trust that data handlers have robust defenses—organizations must proactively ensure that every entity in their supply chain is equipped to prevent such catastrophic breaches. It’s time for their cybersecurity practices but for those of every entity they do business with. The stakes are too high to allow this negligence to continue.”
Ayan Halder, Principal Product Manager, Traceable AI
“When fraudsters have access to key personal details needed to bypass KYC on nearly all American consumers, the question is who to trust anymore? This is where intent-driven risk management shines. Intent-driven risk management looks at how users are behaving “after” getting onto the platform and what are they going after, negating a lot of the risks injected through brittle KYC measures.”
