The massive cybersecurity breach that hit the National Public Data (NPD), a data broker that gathers information from public sources for background checks, has exposed the personal data of nearly three billion people, including Social Security numbers, addresses and email addresses. The breach was perpetrated by a cybercriminal group called "USDoD," which claimed responsibility for the attack. The breach occurred in December 2023 but was not disclosed by the NPD until August 2024, after it accidentally published its own passwords online, making the breach worse.
The breach has triggered a public outcry and a legal backlash against the NPD, which has been accused of violating the privacy rights of millions of Americans. The NPD is facing a consumer advocacy group lawsuit, alleging that the company failed to protect the data it collected and notify the affected consumers. The breach has also highlighted the need for more substantial and more consistent laws and regulations that govern the collection, use and protection of personal data, especially by data brokers that operate with minimal oversight and disclosure. The breach has also revealed the vulnerability of the consumers, who may not be aware of how their data is collected, stored and shared, and who may face the risk of identity theft, fraud and scams.
Several cybersecurity experts from different companies have shared their insights and opinions on the NPD breach and its implications. They have emphasized the importance of enhanced regulations and corporate accountability for data protection and privacy. They have also suggested some best practices and solutions for organizations to prevent and mitigate such breaches. Here are some of their views:
Clyde Williamson, Product Management, Innovations, Protegrity
“Organizations rely on the exchange of data for their vitality. Consumers share their personal identifiable information (PII), like Social Security numbers and emails, with the expectation that businesses will protect this data and comply with privacy laws to prevent unauthorized access. In this case, National Public Data (NPD) scraped individuals' PII from public sources for use in background checks, leaving people unaware if their data was accessed and emphasizing growing concerns regarding customer trust in businesses and their ability to secure their data.
Notably, this breach wasn’t announced for a week; it only came to light and led to a lawsuit earlier because the company didn't disclose it. Further, it’s still unclear whether they intentionally avoided sharing details of this breach or just discovered it themselves. This highlights the inadequacy of U.S. laws in handling citizens' personal data, which are not equipped for the challenges of the 21st century. Data brokers like the NPD also aren’t held to the same regulatory standards as institutions like the Payment Card Industry (PCI), where they’re obligated to conduct annual audits and controls around credit card data. As things stand now, the US has no such obligations.
Most likely, a lot of the stolen data set is from one of our most vulnerable demographics: senior citizens and their families. A popular scam has a threat actor pretending to be a lawyer with bad news for the senior - their family member is in trouble and needs money. And why wouldn’t a grandparent believe them if they had valid PII to validate their credibility? These scammers don’t have to open credit in someone’s name to ruin lives. They just need to know how to use the information stolen to empty a caring family member’s bank account.
As breaches and attack surfaces continue to grow, relying on class action lawsuits for negligence cannot be the best option. Organizations must prioritize transparency and enhance their efforts to de-identify sensitive data to protect consumer information. They must move beyond traditional defense mechanisms and adopt regulator-recommended data protection strategies like encryption and tokenization. These methods render data useless to attackers, making it impossible to steal and use maliciously. By implementing these protections, businesses can diminish the value of stolen data and mitigate the long-term effects of ransomware attacks or fraudulent activities.”
Kiran Chinnagangannagari, Chief Product & Technology Officer, Securin "In the wake of the staggering National Public Data breach, which compromised millions of records on U.S. citizens, the silence from the company until the breach included leaked social security numbers is nothing short of alarming. This breach underscores the profound risks posed by mass data aggregation and sheds a harsh light on the glaring gaps in corporate responsibility when managing and communicating such incidents. The fact that such enormous volumes of personal data are accessible to companies and private investigators, and now the deep and dark web, raises severe doubts about how well-protected our information truly is. This breach lays bare the minimal oversight over who gains access to this data—and what happens afterward. This breach should also serve as a wake-up call, emphasizing the critical need for organizations to rigorous or stricter regulations and better enforcement. Companies must be held accountable, not just for evaluating the cybersecurity practices of their partners and third-party vendors. It’s no longer enough to trust that data handlers have robust defenses—organizations must proactively ensure that every entity in their supply chain is equipped to prevent such catastrophic breaches. It’s time for their cybersecurity practices but for those of every entity they do business with. The stakes are too high to allow this negligence to continue."
Ayan Hadler, Sr. Product Manager, Traceable AI
“When fraudsters have access to key personal details needed to bypass KYC on nearly all American consumers, the question is who to trust anymore? This is where intent-driven risk management shines. Intent-driven risk management looks at how users are behaving "after" getting onto the platform and what are they going after, negating a lot of the risks injected through brittle KYC measures.”
Comentarios