Research Library
National Public Data Breach 2024 Explained
In 2024, a Florida data broker most people had never heard of lost a database containing an estimated 272 million unique Social Security numbers. The company confirmed the breach only after lawsuits were filed, then filed for bankruptcy. This case study covers only confirmed facts, attributed and dated.
What happened, in brief
National Public Data was a background-check data broker operated by Jerico Pictures Inc., a Florida company. It compiled personal records — names, addresses, phone numbers, dates of birth and Social Security numbers — scraped or assembled from public and other sources over many years, and sold them for background checks to employers and investigators. Most of the people in its database had never heard of the company and had never given it their data.
In April 2024, a threat actor using the alias USDoD offered a dataset said to come from National Public Data for sale, asking $3.5 million. In August 2024, a near-complete copy of the data was posted for free on a hacking forum. The company publicly acknowledged the incident in mid-August 2024, after class-action lawsuits were filed. It filed for Chapter 11 bankruptcy on 2 October 2024 and was reported to have ceased operations by December 2024.
Timeline of confirmed events
- Around December 2023: intrusion activity is reported to have begun; the company later said it was aware of an attempted hack from around this time.
- April 2024: data theft occurs; a threat actor using the alias USDoD offers a dataset said to contain about 2.9 billion records for sale for $3.5 million.
- August 2024: a member of a hacking forum posts a near-complete copy of the dataset for free. Class-action lawsuits are filed, and National Public Data publicly acknowledges the incident in mid-August 2024.
- 2 October 2024: National Public Data (Jerico Pictures Inc.) files for Chapter 11 bankruptcy.
- December 2024: the company is reported to have ceased operations.
The numbers: why 2.9 billion does not mean 2.9 billion people
This breach is a lesson in reading breach numbers. The figure most often quoted — 2.9 billion records — comes from the threat actor's claim and counts database rows, not individuals. One person can appear many times: at different addresses over a lifetime, with old and new phone numbers, as separate rows. Independent analysis of the leaked files, including work by security researcher Troy Hunt, found roughly 272 million unique Social Security numbers, with many records duplicated, outdated, or belonging to deceased individuals.
The company itself formally notified about 1.3 million people — a far smaller figure that reflects the notification obligations as the company understood them, not the full reach of the data. The honest statement is this: the exposure of about 272 million unique Social Security numbers is one of the largest such exposures ever recorded, and the exact number of living individuals affected cannot be stated precisely from the public record. Any source that states a single, precise number of affected people without qualification is overstating what is known.
What was exposed, and how the company got the data
According to the company's own breach notice, the information may have included Social Security numbers, names, email addresses, phone numbers and mailing addresses. A class-action lawsuit alleged the company scraped personal information from non-public sources without consent; the sourcing of the broker's data was contested in litigation and is presented here as an allegation in the lawsuit, not as a confirmed fact.
The actor who first offered the data used the alias USDoD; reporting on the chain of the data describes another actor, using the name SXUL, as having provided the data to USDoD. Those aliases are as reported in public coverage and legal filings. No claim is made here about the real identity of any actor, and no leaked data from the breach is reproduced, linked to, or described in detail anywhere on this site.
The response, and the bankruptcy
The company's public acknowledgement came in mid-August 2024, after lawsuits were filed — months after the data was first offered for sale. That delay, and the fact that the company was a small operation holding data on hundreds of millions of people, became central to the public discussion: a background-check broker that most affected people had never heard of had compiled their most permanent identifiers, stored them insecurely, and had limited capacity to respond when they were taken.
Numerous class-action lawsuits followed, and on 2 October 2024 the company filed for Chapter 11 bankruptcy. By December 2024 it was reported to have ceased operations. The lawsuits and the bankruptcy are the reason the company no longer exists; they are also the reason the full story of how the data was held and how the intrusion happened may never be fully documented in public.
What this case means
Three lessons stand out. First, the data-broker economy means your most sensitive identifiers can be held by companies you have never dealt with — and their security is your problem even though you never chose them. Second, breach numbers need reading, not repeating: rows, unique identifiers and affected individuals are three different numbers, and the headline figure is usually the least informative one. Third, a Social Security number cannot be changed. When 272 million of them are exposed, the harm lasts for decades, because the identifier itself remains valid — which is why a credit freeze, not a password change, is the protective step that matters.
That last point is practical, not abstract. If you are in the United States and your Social Security number may have been exposed — in this breach or any other — place a credit freeze with each of the three major credit bureaus. It is free, it stops new credit being opened in your name, and it addresses the actual harm: the permanent identifier in the wrong hands. The same permanent-identifier problem is at the centre of our Equifax case study.
What could not be verified
The exact number of living individuals affected cannot be verified from the public record, for the reasons given above, and this case study does not assert one. The precise method of intrusion was not publicly confirmed in the sources used, and is not described here. The identity of the actors behind the aliases is not confirmed and is not asserted. The allegation in the class-action lawsuit about how the company sourced its data is presented as an allegation, not a finding.
Sources
- Krebs on Security — National Public Data breach reporting (Brian Krebs)
- TechCrunch — National Public Data files for bankruptcy (October 2024)
- National Public Data — breach notice on the company's website (August 2024)
- Troy Hunt — analysis of the leaked data (approximately 272 million unique Social Security numbers)
Frequently asked questions
What was the National Public Data breach?
In 2024, the background-check data broker National Public Data (operated by Jerico Pictures Inc. of Florida) was breached. A threat actor claimed about 2.9 billion records; independent analysis found roughly 272 million unique Social Security numbers, with many duplicate and outdated records.
How many people were affected?
The exact number of individuals is not settled. The threat actor's 2.9 billion figure counts database rows, not people. Independent analysis, including work by researcher Troy Hunt, found about 272 million unique Social Security numbers. The company formally notified about 1.3 million people.
What data was exposed?
Names, addresses, phone numbers, dates of birth and Social Security numbers, according to the company's own breach notice and court filings. Some records were outdated or belonged to deceased individuals.
When did the National Public Data breach happen?
Intrusion activity is reported to date from around December 2023, with data theft occurring from around April 2024. A threat actor using the alias USDoD offered the data for sale in April 2024; a near-complete copy was later posted for free on a hacking forum in August 2024. The company publicly acknowledged the incident in mid-August 2024.
What happened to National Public Data?
The company faced numerous class-action lawsuits, confirmed the breach in August 2024, and filed for Chapter 11 bankruptcy on 2 October 2024. It was reported to have ceased operations by December 2024.
What should I do if my data may have been exposed?
Freeze your credit with the three major bureaus, use strong unique passwords with multi-factor authentication, watch for phishing that uses your personal details, and be wary of any site or service that asks for your Social Security number to 'check' your exposure.