What actually happened
National Public Data was a background-check and data-broker company that aggregated records from public sources court filings, voter registrations, address histories and sold access to third parties. In 2024, a threat actor known as USDoD claimed to have stolen roughly 2.9 billion records from their systems and put the data up for sale on a dark-web forum for $3.5 million.
Over the following months, portions of the dataset leaked for free. Security researchers confirmed the breach contained real, verifiable data. National Public Data eventually acknowledged the incident and the company subsequently filed for bankruptcy in late 2024.
National Public Data collected records on most US adults through public sources. You likely never heard of them that doesn't mean your data wasn't in their database.
What data was exposed
Unlike password breaches where you can just rotate credentials, this breach involved identity data that doesn't change. That's what makes it more dangerous long-term.
| Data Type | Why it matters | Risk Level |
|---|---|---|
| Social Security Numbers | Can be used to open new credit accounts, file fraudulent tax returns, impersonate you | CRITICAL |
| Full Names + Aliases | Enhances phishing attacks and identity fraud | HIGH |
| Date of Birth | Used to answer security questions and verify identity | HIGH |
| Current Address | Enables physical mail fraud, targeted scams | MEDIUM |
| Historical Addresses | Used to pass knowledge-based authentication | MEDIUM |
| Phone Numbers | Enables SIM-swap attacks and targeted calls | MEDIUM |
A password breach is recoverable change the password. An SSN breach is not. That 9-digit number follows you for life. Attackers can use it years later to pass identity checks at banks, insurance providers, and government systems.
The 5 steps to take right now
These steps are ordered by impact. Do them in order, the first two matter most.
A credit freeze is free and blocks anyone from opening new credit in your name. Do all three: Equifax, Experian, and TransUnion. Also consider freezing at ChexSystems for bank account protection.
A fraud alert is weaker than a freeze but still useful. You only need to file at one bureau they're required to notify the others. It prompts lenders to do extra identity verification.
The FTC's identitytheft.gov creates a personalized recovery plan if you've already seen misuse unauthorized accounts, tax issues, or debt collection notices you don't recognize.
Unexpected account-verification letters, new card deliveries you didn't request, IRS notices about duplicate returns, or debt collection calls all are warning signs of ongoing identity fraud.
Check annualcreditreport.com for accounts you didn't open. Review bank and card statements for unfamiliar transactions. Set up transaction alerts if your bank supports them.
A credit freeze stops new credit lines but doesn't prevent misuse of existing accounts, tax fraud, or Social Security benefit fraud. Stay vigilant across all financial touchpoints.
The long-term risk picture
Most identity fraud from large-scale breaches doesn't happen immediately. Stolen identity data gets packaged, resold, and used months or years after the original breach. The combination of name + DOB + SSN + address history is exactly what's needed to impersonate someone in front of a bank or government system.
This is why a one-time check isn't enough. Set a calendar reminder to review your credit report every 3 to 4 months, especially if you suspect you're in the dataset.
DataLeakz monitors breach databases and alerts you when your email shows up in new leaks.
Common questions
Most likely yes, if you're a US adult. NPD aggregated data from public records voter registrations, court filings, property records not just their own customers. You never had to opt in.
The biggest risks are new accounts opened in your name, fraudulent tax returns claiming your refund, and Medicare/benefit fraud. A credit freeze prevents most financial fraud but not tax or benefit fraud — that requires additional vigilance with the IRS and SSA.
No — you can lift and re-apply a freeze at any time, usually within minutes through each bureau's website. A temporary thaw for a specific lender costs nothing and takes a few minutes.
Sources
- Microsoft Support: National Public Data breach — What you need to know
- IBM Think: National Public Data breach publishes private data of billions of U.S. citizens
- FTC Consumer Advice: Credit freezes and fraud alerts — consumer.ftc.gov
- IdentityTheft.gov — FTC data-breach recovery guidance