National Public Data Confirms Hackers Stole Social Security Numbers

A Social Security card sits alongside checks from the U.S. Treasury in Washington, on Oct. 14, 2021. Kevin Dietsch/Getty Images

The company named in a class-action lawsuit last week that claims that billions of Americans’ records including Social Security numbers were stolen in a data breach confirmed that it was hacked.

In a notice published by the Maine attorney general’s office on Aug. 17, National Public Data said that 1.3 million people, including more than 2,000 Maine residents, were affected by the data breach. The lawsuit, filed earlier this month, alleged that the personal information, including Social Security numbers, of hundreds of millions of Americans were hacked and leaked online.

The Florida-based firm also sent letters, dated Aug. 10, to consumers about the breach, informing them that it “learned of a data security incident potentially involving ... personal information.”

“The incident is believed to have involved a third-party bad actor that was trying to hack into data in late December 2023, with potential leaks of certain data in April 2024 and summer 2024,” the letter stated, adding that personal information such as Social Security numbers, mailing addresses, email addresses, names, phone numbers, and other data were targeted.

The company, in an undated statement published last week on its website, also confirmed the data breach and advised consumers that they should try to mitigate any potential harm associated with Social Security numbers being used for nefarious purposes. That included contacting the three major U.S. credit reporting agencies, Equifax, TransUnion, and Experian, to get a free credit report.

National Public Data did not say in the statement how many people may have been affected by the breach and made no reference to the class-action lawsuit.

“It is also recommended that you place a free fraud alert on your credit file. A fraud alert tells creditors to contact you before they open any new accounts or change your existing accounts,” the company said.

Lawsuit’s Allegations

The complaint was filed in the U.S. District Court for the Southern District of Florida and alleges that cybercrime organization USDoD hacked the firm and that hackers then put the database for sale on the dark web for $3.5 million.

The suit further alleges that about 2.9 billion records, including names and Social Security numbers, span at least the last three decades.

The plaintiff, listed as Christopher Hoffman on behalf of others affected, has accused National Public Data of failing to “properly secure and safeguard the personally identifiable information that it collected and maintained as part of its regular business practices.”

The complaint alleges that individuals affected by the breach were not customers of National Public Data; rather, their information was “scraped” by “unauthorized third parties” and shared with the company without their knowledge, it states.

According to the lawsuit, the company held unencrypted personal records, which made them easily accessible to hackers, and the hackers were able to “exfiltrate” the unencrypted data of billions of individuals stored on the company’s network.

In its letter to the Maine attorney general and its statement, National Public Data did not respond to the allegations in the lawsuit. The Epoch Times contacted National Public Data for additional comment but didn’t receive a reply by press time.

NTD’s Rachel Acenas contributed to this report.