National Public Data, 2024: a company you never used, holding everything about you

Every other case in this archive involves a company someone chose to deal with. This one does not. National Public Data was a background-check broker that compiled profiles on people who had never heard of it, never agreed to anything, and had no practical way to leave, and in 2024 the compilation went public.

What happened

In April 2024, an actor using the handle USDoD advertised a dataset said to contain 2.9 billion rows of personal data covering the United States, the United Kingdom and Canada, at an asking price of $3.5 million. Portions circulated through the summer, and in August large parts were published free on a criminal forum.

The records contained names, current and historical addresses, Social Security numbers, phone numbers, and in many cases lists of relatives and associates, the standard shape of a background-check profile.

The company compounded the story: researchers found that a sister site operated by the same business was publishing an archive containing plaintext credentials for its own administrative back end. Whatever the original route in, the operational standard on display did not suggest a well-defended organisation.

The consent problem

The uncomfortable centre of this case is that no one in the file did anything.

Brokers assemble profiles from public records, property filings, voter registrations, court records, licences, combined with marketing data, purchase histories and datasets bought from other brokers. The individual is neither a customer nor a user. They are inventory.

That produces three distinct harms:

1. No notice. Most people in the file only learned it existed when it leaked.
2. No control. Opt-out processes, where they exist, are per-broker, manual, and have to be repeated because the data gets re-acquired from other brokers.
3. No accountability that matches the scale. The company filed for bankruptcy. The data remains in circulation permanently.

It is the argument for regulating the industry, made more persuasively by events than by any advocate.

What the data is actually good for

Being realistic about the risk matters more than being alarmed by the row count.

A Social Security number with a name and date of birth supports new-account fraud, which a credit freeze blocks. Historic addresses and relatives' names support knowledge-based identity verification, the "which of these streets have you lived on?" questions that banks and telecoms still use, which is why those questions have been quietly dying for years.

The most reliable use, though, is targeting. A caller who knows your previous address, your mother's name and the last four digits of your Social Security number sounds exactly like your bank. The data does not enable the fraud directly; it makes the person on the phone credible, and credibility is what the fraud actually needs.

The timeline

1. Late 2023 – early 2024: The data is obtained from National Public Data's systems.
2. April 2024: A dataset advertised at 2.9 billion rows is offered for sale.
3. June–July 2024: Portions circulate; class actions begin; researchers start analysing samples.
4. August 2024: Large portions are published free; the company confirms a breach; a sister site is found exposing plaintext credentials.
5. October 2024: The parent company files for Chapter 11 bankruptcy protection.

What it changed

Data brokers entered public consciousness. The industry had been a specialist concern. A leak that touched most American adults, from a company none of them could name, made "who else holds my file?" a mainstream question and strengthened the case for state-level deletion mechanisms.

Knowledge-based verification lost more ground. If everyone's address history is public, questions about address history verify nothing. The migration towards document verification, device binding and one-time codes accelerated.

Bankruptcy as a liability exit got noticed. A broker that profits from compiling data, loses it, and then dissolves leaves victims with a permanent exposure and no counterparty. It is now a live question in policy discussions about bonding and insurance requirements for data brokers.

What to actually do