Data of 2.9 Billion People Leaked onto the Dark Web

Nearly 2.9 billion individuals' personal data was exposed on the dark web after an April 2024 breach of National Public Data, a background-check company. The data, allegedly stolen by the cybercriminal group USDoD, was offered for sale at $3.5 million on the Dark Web, as detailed in a Bloomberg Law report.

The data breach occurred in April 2024 and involved Jerico Pictures Inc., operating as National Public Data, a company that aggregates and stores personal information from various sources for background checks. On April 8, 2024, the cybercriminal group USDoD posted a database titled "National Public Data" on a dark web forum.

The stolen data included sensitive information such as Social Security numbers, names, current and past addresses, and details about relatives, some deceased for nearly two decades. According to National Public Data, the data comes from public, state, and national databases, as well as court records and other unspecified sources.

In response, a class action lawsuit has been filed in the U.S. District Court for the Southern District of Florida against National Public Data. The lawsuit, led by plaintiff Christopher Hofmann, a California resident, accuses the company of negligence, unjust enrichment, and breaches of fiduciary duty and third-party beneficiary contract. It seeks court orders to compel National Public Data to delete the compromised data and implement stronger cybersecurity measures.

According to the lawsuit, the exact timing and method of the breach remain unclear, and National Public Data has yet to notify the affected individuals. The plaintiff, Mr. Hofmann, only became aware of the leak thanks to an alert from his personal identity theft protection service provider on July 24.

The lawsuit also claims that National Public Data collected personal information from non-public sources without notifying individuals that their data could be vulnerable:

“... Defendant scrapes the PII of potentially billions of individuals from non-public sources.2 Plaintiff and Class Members at no point knowingly provided their PII to Defendant and Defendant instead scraped their PII from non-public sources. To make matters even worse, Defendant did this without Plaintiff’s and Class Members’ consent or knowledge.”

While of historical scale, this is not the first blockbuster breach this year. In May hackers posted 1.3TB of Ticketmaster data for sale, containing the personal and financial details of 560 million people. A breach at AT&T also exposed the information of 70 million customers, including their social security numbers.