National Public Data breach: what happened and what to do
National Public Data, a US background check site, was breached in 2024. Have I Been Pwned lists 133,957,569 accounts, with names, addresses, phone numbers, dates of birth and Social Security numbers. HIBP flags the data as unverified.
View all 13,115 breaches- Breach date
- 9 Apr 2024
- Affected
- 133,957,569
- Data exposed
- Dates of birth, Email addresses, Genders, Government issued IDs, Names, Phone numbers, Physical addresses
- Verified
- Not verified
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
National Public Data (NPD) was a US data broker, a company that collects personal records from public and commercial sources and sells searches on them.
In 2024, a very large file of records tied to NPD was released online. Have I Been Pwned (HIBP) dates the breach to 9 April 2024, added it on 13 August 2024 and lists 133,957,569 affected email addresses. HIBP marks the breach as unverified. That means it couldn't confirm with the company that the data came from its systems.
Other outlets reported much larger totals, including roughly 300 million people and billions of rows. Counts vary because the file held many duplicate and overlapping records. For a count, use HIBP's.
The company that owned NPD, Jerico Pictures, filed for Chapter 11 bankruptcy in the Southern District of Florida on 2 October 2024. In that filing it said it was unlikely to be able to cover its liabilities, including credit monitoring for people affected. Reporting at the time said the Federal Trade Commission was investigating, that more than 20 states had threatened civil penalties and that the company faced around 20 class action lawsuits.
What was exposed
HIBP lists seven types of data: names, email addresses, phone numbers, physical addresses, dates of birth, genders and government issued IDs. Reporting says the government IDs were Social Security numbers. A filing with the Maine attorney general listed at least 1.3 million individuals.
You didn't give this data to NPD. Brokers like it collect records on people who never signed up, which is why many people in the file have never heard of the company.
What that lets criminals do
A full name, address, date of birth and Social Security number is a complete identity-theft kit. It can be used to open credit accounts, file false tax returns or claim benefits.
The phone numbers and email addresses help with the next step. Scammers can phone or text you using details that sound like they come from your bank or an agency. Public people-search listings often carry the same details.
The company's response
NPD's owner filed for bankruptcy and said it couldn't cover credit monitoring. You shouldn't expect the company to help you directly. Don't pay anyone who contacts you offering to "remove you from the leak". Nobody can.
What can and can't be undone
Leaked records can't be pulled back. What you can do is limit the damage with a credit freeze and cut down the public listings that carry the same details. Those are separate jobs. A freeze takes minutes. Reducing listings takes longer, because new ones keep appearing as brokers refresh their data.
What to do if you were in it
- 1
Freeze your credit at Equifax, Experian and TransUnion
It's free and blocks new accounts opened with your Social Security number. Lift it for a few days when you apply for credit yourself.
- 2
Check your credit reports
Pull your free reports and look for accounts, inquiries or addresses you don't recognize. Dispute anything that isn't yours.
- 3
Consider an IRS Identity Protection PIN
It stops someone else filing a tax return with your Social Security number. You can request one from the IRS.
- 4
Expect calls, texts and emails that know your details
Don't give anything out to someone who contacted you first. Hang up and call the organization on a number you look up yourself.
- 5
Reduce what people-search sites list about you
The same names, addresses and phone numbers show up on people-search sites, which makes the leak easier to use. You can opt out site by site, or let Serus find the sites that list you where you live and file the removals.
- 6
Check whether your email or phone number is in this and other breaches
A free scan from Serus shows which breaches include your email or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the alert tells you what to change.
Frequently asked
Was I affected by the National Public Data breach?
You can search your email on Have I Been Pwned. Because NPD collected records on people who never used it, you can be in the data without being a customer, and the HIBP list only covers the email addresses it received.
Was my Social Security number leaked?
Reporting says Social Security numbers were in the data, and HIBP lists government issued IDs. Treat it as exposed and freeze your credit.
Is there a settlement?
Reports say the company faced class action lawsuits and filed for bankruptcy in October 2024. We haven't seen a settlement you can claim, so check the official court pages.
Can I remove my data from National Public Data?
The leak itself can't be recalled. Public listings on people-search sites can be removed on request.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
