MC2 Data breach: what happened and what to do

What happened

MC2 Data is a US data aggregator that sold access to background-check and people-search style records under several brand names, including PrivateRecords.net, PeopleSearcher and PeopleSearchUSA. In August 2024 it left a database publicly accessible without a password. Researchers at Cybernews found it on August 7 and reported that the exposed data held more than 100 million records about US residents, around 2.2 TB in total. Reports pointed to human error rather than a hacking attack.

Have I Been Pwned (HIBP) treats one part of that exposure as a breach: the subscriber records. It dates the breach to August 18, 2024, added it on December 15, 2024, and counts 2,122,280 accounts. These are people who subscribed to MC2's services, not the people the background reports were about. Cybernews' own figure for the subscriber list was slightly higher, at about 2.3 million.

What was exposed

For the subscriber accounts, HIBP lists email addresses, names and salted SHA-256 password hashes. A hash is a scrambled form of a password. Salted hashes are harder to crack than plain ones, but weak or common passwords can still be guessed.

The wider database, which Cybernews described, held much more: names, home addresses, dates of birth, phone numbers, property and legal records and employment history for people searched through MC2's sites. Outlets disagree on whether payment information was included. That wider data is not part of the HIBP count, and there is no way to check it by email address.

Why this one is awkward

If you paid for one of these services, you were a customer of a people-search business that then exposed your login details. If you never heard of MC2 Data, you could still be in the larger set: background check data is compiled from public records without anyone's consent, then resold.

For subscribers, the main risk is password reuse. For everyone else the risk is the same as with any people-search leak: your address, phone number and relatives are easier for scammers and stalkers to find and use.

What the company has said

MC2 Data hasn't published a public notice. Check the company's sites directly rather than links in messages.

Was your data included

Check your email on Have I Been Pwned or run a free Serus scan, which checks your email and phone number against breaches. Serus can't remove breach data, but it monitors for new exposures and alerts you.

What the numbers mean

There are two figures to keep apart. The 2,122,280 count from HIBP is the subscriber list: people who held accounts with MC2's sites. The 100 million figure from Cybernews is a count of records about people in the background-check database, and a person can appear there without ever having signed up for anything.

The second group has no login to protect, so the useful response is to shrink what the sites show about you. People-search sites list your name, address, phone number and relatives, and each has its own opt-out form.