A Vast Trove of Exposed Social Security Numbers May Put Millions at Risk of Identity Theft

UpGuard researchers uncovered a publicly accessible database hosted by Hetzner containing approximately 3 billion email/password pairs and about 2.7 billion records with Social Security numbers, likely aggregated from multiple past breaches (potentially including the 2024 National Public Data incident). Unable to locate the owner, they alerted Hetzner on January 16 and the data was removed on January 21; analysis of a 2.8 million record sample and password cultural references points to much of the data originating around 2015 in the U.S., with some identities exposed but not yet exploited.