Social Security Data Breach: What to Do, How to Check, How to Protect Yourself in 2024
The National Public Data breach dumped 272 million social security numbers onto the dark web. To find out whether yours was among them and learn how to protect yourself, read this urgent article on the social security data breach.
Written by Samuel Chapman (Writer, Editor)
Reviewed by Brett Day (Writer, Editor)
Facts checked by Simona Ivanovski (Fact-Checker)
Last Updated: 2024-09-02T20:41:15+00:00
All our content is written fully by humans; we do not publish AI writing. Learn more here.
In a way, the data compromised in the National Public Data breach was stolen twice: first by the data broker itself — which allegedly scraped it from protected sources without its subjects’ permission — and then a second time by the hacker or hackers known as SXUL. We’ll explain how to tell if this social security data breach impacted you and what you can do about it.
The most important thing to know about the NPD breach is that it’s both more and less alarming than it seems. The reported theft of 2.9 billion records counts each individual line of data, not each impacted person. Since many people have changed addresses several times, the actual number of impacted people is much lower, though it could still be over 250 million.
On the scarier side, the compromised records are supposedly extensive, including names, social security numbers, birth dates, phone numbers, addresses and other personal data. That’s more than enough for a criminal to use for identity theft and financial crimes.
Don’t feel powerless, though, as you can take steps to mitigate the damage and protect yourself from the next breach. Start by securing your accounts with strong passwords and multi-factor authentication. Using one of the best password managers can help. You can also read our guide on how to protect your privacy.
Achieve Online Privacy and Security Even as a VPN Novice
- Comprehend the essential role a VPN plays in safeguarding your digital life
- Gain a deep understanding of how VPNs function under the hood
- Develop the ability to distinguish fact from fiction in VPN promotions
In addition to the specific advice we’ll share right now, make sure you’re following all the tips in our comprehensive online privacy guide. Our data privacy statistics also show just how costly identity theft can be.
What Happened to My Data in the National Public Data Breach 2024?
Jerico Pictures, which operates under the name National Public Data (NPD), is a Florida-based company that conducts background checks for employers and investigators. Although it doesn’t explain how it gets its data, a class-action lawsuit alleges that NPD “scraped their PII (personally identifiable information) from non-public sources.”
By its own admission, NPD was aware of an attempted hack as far back as December 2023, though the data theft itself occurred in April 2024. Investigations suggest that the weak point was a sister site of NPD, RecordsCheck.net, which left administrative credentials for NPD on an unencrypted and easily obtainable file on its website.
The hacker or hackers, who likely went by the name SXUL, gave the data to USDoD, a group that has served as a broker for previous data breaches. USDoD initially attempted to sell the stolen data for $3.5 million. However, it seems there weren’t any takers, as a member named “Fenice” turned up on BreachForums in August offering the entire file for free.
Since it’s difficult to trace the origin of stolen information, it’s hard to say whether this breach has led directly to any crimes. Also, security researchers are still verifying the 2.7 billion leaked records, with many already turning out to be inaccurate. Currently, our best guess is that 272 million unique SSNs were compromised, though many belong to deceased individuals.
NPD Response to Data Theft
In the United States, there are essentially no regulatory barriers to starting a data brokerage business, so it’s not surprising that many are totally incompetent at protecting your data and utterly helpless in a crisis. NPD released a statement on the breach that essentially tells all the victims of its blundering that they’re on their own.
Specifically, NPD says that it “will try to notify you if there are further significant developments applicable to you,” though NPD itself doesn’t appear to have notified anybody. It further claims to have “implemented additional security measures,” but with no specifics, it’s best to assume that these measures don’t exist.
How to Check If My Social Security Data Was Compromised
The good news is that cybersecurity companies have stepped into the gap where NPD has failed. Atlas Privacy — which is also attempting to verify the leaked information — has built a website where you can search the stolen records by name, SSN or phone number. Pentester offers another site that allows you to search by name, state and birth year.
Search for Your Social Security Number in the NPD Breach
We recommend using both npdbreach.com (the Atlas Privacy site) and npd.pentester.com (the Pentester site) to check for your SSN in the leaked NPD data. Make sure to check previous addresses and names if yours have changed. If your SSN appears on either site, proceed directly to the next section, which explains how to protect yourself.
How to Protect Yourself From a Social Security Data Breach
If you’ve discovered that your SSN was part of the NPD breach, take these steps immediately. The advice below pertains to individuals, but if you run a business, you may also want to sign up for a cyber insurance plan.
Freeze Your Credit
Contact each of the three credit bureaus and request a freeze on your credit. The bureaus will assign you a unique number you can use to lift the freeze. Credit freezes are free and don’t hurt your credit score. They simply make it more difficult for anybody to access your credit files without your permission, including the credit bureau itself.
from charging you to place or lift a credit freeze.
Be warned that the credit bureaus also offer “credit lock” services. Although they purport to do the same thing, a credit lock is not the same as a freeze. A credit freeze is a regulated service guaranteed by federal law, while a lock comes with no protections requiring it to work as advertised.
Final Thoughts
Although the media has inflated the threat from the NPD breach, with many outlets erroneously stating that 2.9 billion people were affected, the exposure of 272 million social security numbers is still an extremely serious matter. As soon as possible, use Atlas Privacy or Pentester to check for your information in the breach and take mitigating actions.
We’d love to hear your comments on how the NPD breach has affected you. Was your SSN exposed? Have you used a credit monitoring or opt-out service? Do you agree that data brokers should be more closely regulated? Let us know, and thanks for reading.
FAQ: Social Security Number Data Breach Protection
If your SSN appears in a data breach, immediately freeze your credit with TransUnion, Equifax and Experian. This prevents the identity thief from posing as you to open new accounts.
At npdbreach.com, search by your social security number to see if it appears in the leaked data.