National Public Data confirms data breach by ‘bad actor’

National Public Data acknowledges that a data breach has occurred and personal information has been stolen.

In a security incident report, the company says the incident happened in late December 2023 and involved a ‘third-party bad actor’ that tried to steal personally identifiable information (PII). Some data leaked last April and during the Summer, including names, email addresses, phone numbers, mailing addresses and social security numbers.

“We cooperated with law enforcement and governmental investigators and conducted a review of the potentially affected records and will try to notify you if there are further significant developments applicable to you,” National Public Data says.

Furthermore, additional security measures were implemented to prevent another security breach in the future. The company advises victims to take preventive measures to detect and prevent any misuse of their personal information. To do so, National Public Data offers their clients identity theft, fraud, and credit reporting services for free.

National Public Data is a company that collects and sells people’s personal information when they apply for a job, or are subjected to an investigation by a private investigator.

Earlier this month a threat actor that goes by the moniker ‘Fenice’ offered an extensive version of the data that was stolen from the company on the dark web. It was 277 GB in size and contained approximately 2.7 billion names, social security numbers and other PPI.

Troy Hunt, the Australian security expert and developer of the Have I Been Pwned database with compromised personal data, discovered that one version of the leaked database contained 134 million unique email addresses.

Security researchers found that some records were incorrect. For example, a number of social security numbers were associated with other people, or belonged to deceased persons.

The data breach has led to a class-action lawsuit against Jerico Pictures, who’s doing business as National Public Data. According to the filing, the complaint is launched against the defendant “for its failure to properly secure and safeguard the personally identifiable information that it collected and maintained as part of its regular business practices”.