National Public Data Breach: 2.7bn Records Leaked on Dark Web

In August 2024, National Public Data acknowledged a breach after roughly 2.7 billion unencrypted records (including names, addresses and Social Security numbers) were posted on dark web forums; investigators traced the leak to a chain of criminal aliases (SXUL, USDoD, Fenice) and identified a likely initial access vector via exposed plaintext credentials and source code on a sister site (RecordsCheck). The dataset contains many duplicate or outdated entries but includes sensitive PII for a very large number of U.S. residents; the report outlines impacts, expert commentary on the value of aggregated data for criminals, and defensive recommendations such as credit monitoring, freezing, encryption, MFA, and regulatory action.