Here we go again. Another MASSIVE DATA BREACH.

[omega man]

Hackers may have stolen the Social Security numbers of many Americans. Here's what to know.​

A new lawsuit is claiming hackers have gained access to the personal information of "billions of individuals," including their Social Security numbers, current and past addresses and the names of siblings and parents — personal data that could allow fraudsters to infiltrate financial accounts or take out loans in their names.

The allegation arose in a lawsuit filed earlier this month by Christopher Hofmann, a California resident who claims his identity theft protection service alerted him that his personal information had been leaked to the dark web by the "nationalpublicdata.com" breach. The lawsuit was earlier reported by Bloomberg Law.

The breach allegedly occurred around April 2024, with a hacker group called USDoD exfiltrating the unencrypted personal information of billions of individuals from a company called National Public Data (NPD), a background check company, according to the lawsuit. Earlier this month, a hacker leaked a version of the stolen NPD data for free on a hacking forum, tech site Bleeping Computer reported.

That hacker claimed the stolen files include 2.7 billion records, with each listing a person's full name, address, date of birth, Social Security number and phone number, Bleeping Computer said. While it's unclear how many people that includes, it's likely "that everyone with a Social Security number was impacted," said Cliff Steinhauer, director of information security and engagement at The National Cybersecurity Alliance, a nonprofit that promotes online safety.

Full story here and it would seem many other sources-

Hackers may have stolen the Social Security numbers of many Americans. Here's what to know.

Lawsuit claims hackers accessed "billions" of records, including Social Security numbers, by breaching background check company.

www.cbsnews.com

OM

 

[jandhumphreyme]

I just read about this day before yesterday, impressive. We put a freeze on credit immediately. Never thought to post about it here, thanks for this.

 

[PGlaves]

If any company that had its data leaked had to pay $10,000 to every person whose data was stolen they would better secure the data or not collect and store it at all in an identifiable manner. Failures should have consequences.

 

[jandhumphreyme]

If any company that had its data leaked had to pay $10,000 to every person whose data was stolen they would better secure the data or not collect and store it at all in an identifiable manner. Failures should have consequences.

I think a fine is a great place to start and full restitution to those whose identity is stolen.

 

[omega man]

More from LA Times-

Hackers may have stolen the Social Security numbers of every American. Here's how to protect yourself

In an epic data breach, hackers claim to have taken 2.9 billion personal records from National Public Data. Most of the data are leaked online.

www.latimes.com

OM

 

[mikegalbicka]

Looking to Freeze Your Credit After the National Public Data Breach?​

Here’s How

Courtesy CNET

 

[omega man]

Looking to Freeze Your Credit After the National Public Data Breach?​

Here’s How

Courtesy CNET

OM

 

[GTRider]

Pentester.com now has a search tool up that will let one search the compromised NPD data to see if your info is contained in the breach.

NPD Breach Check - Pentester.com

npd.pentester.com

The site also includes links to the three credit bureaus where a credit freeze can be added.

Like everyone, I am mad as hell at the hackers responsible for this. But I am more angry with all the business entities we routinely deal with who refuse to provide services unless we give them a SS number, then they hold that data on net-connected servers that can be breached. That’s banks, utility companies, cell service providers, etc. etc. etc. Then when a breach occurs, they take the cheap approach out by just providing a year’s worth of supposed net monitoring to see if your data is out there or being used, and putting the onus for dealing with the problems on the backs of consumers: credit freezes, ongoing and more extensive monitoring, etc. It’s long past time to ban the use of SS numbers for routine services like utilities and cell providers and such, and put full fiscal responsibility for protecting SS data on those few business areas that may have legitimate need to hold that data (banks, investment services, etc where tax implications arise).

Best,
DeVern

 

[PGlaves]

Pentester.com now has a search tool up that will let one search the compromised NPD data to see if your info is contained in the breach.

NPD Breach Check - Pentester.com

npd.pentester.com

The site also includes links to the three credit bureaus where a credit freeze can be added.

Like everyone, I am mad as hell at the hackers responsible for this. But I am more angry with all the business entities we routinely deal with who refuse to provide services unless we give them a SS number, then they hold that data on net-connected servers that can be breached. That’s banks, utility companies, cell service providers, etc. etc. etc. Then when a breach occurs, they take the cheap approach out by just providing a year’s worth of supposed net monitoring to see if your data is out there or being used, and putting the onus for dealing with the problems on the backs of consumers: credit freezes, ongoing and more extensive monitoring, etc. It’s long past time to ban the use of SS numbers for routine services like utilities and cell providers and such, and put full fiscal responsibility for protecting SS data on those few business areas that may have legitimate need to hold that data (banks, investment services, etc where tax implications arise).

Best,
DeVern

Which is why I say there should be a fine/and payment for every identity stolen - whether it is shown that the person is harmed or not. If there is a several thousand dollar penalty for each identity stolen the information would be better protected or anonymized. As it is it is cheaper to dodge responsibility than it is to protect information. I'd recommend a $10,000 fine plus a $10,000 payment to the person whose Identity is compromised as a good start.

I am reminded of the Ford Motor Company cost-benefit analysis that concluded it was lest costly - more profitable - to pay any damage claims for the fire exuberant Ford Pinto than to fix the problem.

 

[98lee]

Looking to Freeze Your Credit After the National Public Data Breach?​

Here’s How

Courtesy CNET

I think mine is still frozen from the last major breech a decade or so ago.

 

[omega man]

It would seem that those extending credit should be held, or at least share, responsibility for not properly vetting a person applying for credit?
OM