A massive database containing over 2.7 billion records has reportedly ended up on a criminal forum. These records belong to individuals in the US and were allegedly stolen from National Public Data (NPD). While the accuracy of the leaked data could not be verified, the hackers reportedly obtained sensitive information such as names, mailing addresses, and social security numbers. The scale of this breach is so vast that if you live in the US, it’s likely that some of your data is included.
GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE
What you need to know
Bleeping Computer reported that the database was posted on the criminal forum Breachforums, where threat actors often post such leaks. What’s interesting is that the stolen database was up for free download. The user who posted it credited a hacker named “SXUL,” saying, “There’s a new player in town.” Usually, hackers sell leaked databases like this one for huge sums.
The database has been stolen from NPD, which collects data from public sources to compile individual user profiles for people in the US and other countries. NPD then sells this private data to all kinds of organizations, such as background check websites, investigators, app developers, and data resellers.
While the database has 2.7 billion records, it’s important to note that this doesn’t necessarily mean 2.7 billion people were impacted. Many of these records are repetitive, and some are incorrect. Still, the breach affects a significant number of people in the States.
This isn’t the first time NPD data has ended up on criminal forums. Bleeping Computer noted that back in April, a hacker known as USDoD claimed to be selling 2.9 billion records with personal data from people in the US, UK, and Canada, which was also stolen from NPD.
Bleeping Computer
NPD is facing consequences
NPD, owned by Jerico Pictures, is facing multiple lawsuits for not protecting people’s data. One lawsuit, filed by California resident Christopher Hofmann, says NPD was negligent and breached its fiduciary duties and a third-party contract.
The plaintiff wants the court to order NPD to delete all the personal info it has collected and start encrypting data from now on. They’re also asking for more than just money—like having NPD set up data segmentation, run regular database scans, put in place a threat-management program, and get a third party to check its cybersecurity every year for the next 10 years.
We reached out to NPD for a comment but did not hear back before our deadline.
It’s time to invest in identity theft protection
Hofmann learned about the data breach through his identity theft protection service, which detected his data in the leaked database. The service notified Hofmann, prompting him to take action and file a lawsuit. Data breaches happen every day, and most never make the headlines, but with an identity theft protection service, you’ll be notified if and when you are affected.
While there are many services that you can sign up for, my top recommendation is Identity Guard. It can monitor personal information like your Social Security Number (SSN), phone number, and email address and alert you if it is being sold on the dark web or being used to open an account. It can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.
One of the best parts of using Identity Guard is that they might include identity theft insurance of up to 1 million dollars to cover losses and legal fees and a white glove fraud resolution team where a US-based case manager helps you recover any losses.
CyberGuy’s Exclusive Offer: Get the Identity Guard Ultra protection to protect your identity and credit for as little as $9.99/mo (lowest offered anywhere) for the first year.
See my tips and best picks on how to protect yourself from identity theft.
5 ways to protect yourself from data breaches
In addition to opting for an identity theft protection service, you can follow these tips to protect yourself from data breaches.
1) Remove your personal information from the internet: While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap – and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
My top recommendation is Incogni, which has a very clean interface and will scan 195 websites for your information and remove it and keep it removed.
Special for CyberGuy Readers (60% off): Incogni offers A 30-day money-back guarantee and then charges a special CyberGuy discount only through the links in this article of $5.99/month for one person (billed annually) or $13.19/month for your family (up to 4 people) on their annual plan and get a fully automated data removal service, including recurring removal from 190+ data brokers. You can add up to 3 emails, 3 home addresses and 3 phone numbers (U.S. citizens only) and have them removed from data-broker databases. I recommend the family plan because it works out to only $4.12 per person per month for year-round coverage. It’s an excellent service, and I highly recommend at least trying it out to see what it’s all about.
Get Incogni for your family (up to 4 people) here
2) Be wary of mailbox communications: Bad actors may also try to scam you through snail mail. The data leak gives them access to your address. They may impersonate people or brands you know and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
3) Be cautious of phishing attempts: Be vigilant about emails, phone calls, or messages from unknown sources asking for personal information. Avoid clicking on suspicious links or providing sensitive details unless you can verify the legitimacy of the request. The best way to protect yourself from clicking malicious links that install malware is to have strong antivirus protection installed on all your devices.
My top pick is TotalAV, and you can get a limited-time deal for CyberGuy readers: $19 your first year (80% off) for the TotalAV Antivirus Pro package.
4) Monitor your accounts: Breaches of this magnitude will make it a necessity for you to start routinely reviewing your bank accounts, credit card statements, and other financial accounts for any unauthorized activity. If you notice any suspicious transactions, report them immediately to your bank or credit card company.
5) Recognizing and reporting a Social Security scam: If there is a problem with a person’s Social Security number or record, Social Security will typically mail a letter. You can learn more about recognizing Social Security-related scams, including how to report a scam quickly and easily online to Social Security’s Office of the Inspector General, by reading more at www.ssa.gov/scams.
Top ways to keep your social security number safe
1) Hide/safe keep your social security number card
Put your social security number card in a very safe place, such as a safe, bank safe, or filing cabinet that can be locked. Because it is used so frequently, those 9 digits are worth memorizing. If your wallet is lost or stolen and you keep your SSN card in there, it will be messier than losing just money or your ID. Don’t carry your social security card in your wallet or purse!
2) Use an identity theft or fraud protection service
Companies such as Identity Guard can monitor your SSN and alert you if it is sold on the dark web or being used to open an account. The faster you know, the quicker you can shut down the damage. In fact, some companies will help you freeze your bank and credit card accounts to prevent further use by criminals. Fortunately, taking advantage of stellar fraud protection from our top pick, Identity Guard is even more affordable with an exclusive CyberGuy savings (up to 52% off).
3) Go online
Skip jotting down your social security number on in-person forms. When your social security number is jotted down on paper, it is hard to control how the information gets used or disposed of. If you can submit forms online, you can skip the risk of having your SSN from getting into the wrong hands. If you mail in forms that denote your SSN, you risk having that piece of mail stolen or lost.
4) Opt out of inputting SSN
Even though your SSN is requested on some forms, it is not always necessary. If a future employer is requesting your SSN, double-check why they need it. They would most likely need it to run a background check, which you should know about anyway. Additionally, some establishments allow you to provide the last 4-digits of your SSN until you are finalizing a screening process, etc.
5) Sign up for a social security account:
Go to the official Social Security Administration website to create an account. Because only one account can be created per social security number, it is safer if you claim it so no one else can by piecing together your personal information (along with your SSN) to claim it fraudulently. Make sure it is connected to a secure email account that you check frequently. This account also provides up-to-date data on earnings and benefit distributions so you can see if anything is ‘off’.
6) Combat child identity theft
Open accounts for your children’s SSNs because you want to claim them for them early and be able to monitor any movement related to their social security number.
7) Secure documents
Some records that contain your social security number are important to keep on hand, such as income tax filings. If they are kept digitally, encrypt and or password-protect the document or folder, especially if it is uploaded to the cloud. Keep offline documents with SSNs in a safe or shred instead of throwing them away.
Remember you (usually) only get one social security number in a lifetime, it is important to safeguard that data with your ‘life’!
8) Remove your personal information from the internet
As mentioned above, a data removal service does all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites.
My top recommendation is Incogni, which has a very clean interface and will scan 195 websites for your information and remove it and keep it removed.
Special for CyberGuy Readers (60% off): Incogni offers A 30-day money-back guarantee and then charges a special CyberGuy discount only through the links in this article of $5.99/month for one person (billed annually) or $13.19/month for your family (up to 4 people) on their annual plan and get a fully automated data removal service, including recurring removal from 175+ data brokers. You can add up to 3 emails, 3 home addresses and 3 phone numbers (U.S. citizens only) and have them removed from data-broker databases. I recommend the family plan because it works out to only $4.12 per person per month for year-round coverage. It’s an excellent service, and I highly recommend at least trying it out to see what it’s all about.
Get Incogni for your family (up to 4 people) here
9) IRS Identity Protection PIN (IP PIN)
To further protect your tax returns from identity theft, the IRS offers an Identity Protection PIN (IP PIN). This is a six-digit number that prevents someone else from filing a tax return using your Social Security number or Individual Taxpayer Identification Number (ITIN). The IP PIN is known only to you and the IRS, adding an extra layer of security to your tax filings.
How to get an IP PIN
- Online Request: The fastest way to receive an IP PIN is to request one through your online account on the IRS website. If you don’t already have an account, you must register to validate your identity.
- Alternative Methods: If you can’t establish an online account, there are other methods, but they take longer. You can file an application or request in-person authentication.
Using Your IP PIN
- Enter the six-digit IP PIN when prompted by your tax software or provide it to your trusted tax professional when filing your return.
- An IP PIN must be used on all federal tax returns during the year, including prior year returns.
- Do not reveal your IP PIN to anyone except your tax professional when you are ready to sign and submit your return.
Important information
- An IP PIN is valid for one calendar year, and a new one is generated each year.
- If you lose your IP PIN, you can retrieve it online or have it reissued by calling the IRS.
By using an IP PIN, you can significantly reduce the risk of tax-related identity theft and ensure that your tax returns are processed smoothly and securely.
HERE’S WHAT RUTHLESS HACKERS STOLE FROM 110 MILLION AT&T CUSTOMERS
Kurt’s key takeaway
If the database leak is legit, this is a big security fail on NPD’s part. Since their whole business is based on collecting and selling data, they should have strong encryption and security in place—especially if this isn’t the first time hackers have targeted them. If they’re putting people at risk, they should be held responsible and cover any financial losses people face because of the leak.
How do you feel about companies that collect and sell data? Do you think they should be held accountable for breaches? Let us know in the comments below.
FOR MORE OF MY SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE
Copyright 2024 CyberGuy.com. All rights reserved. CyberGuy.com articles and content may contain affiliate links that earn a commission when purchases are made.
12 comments