National Public Data Breach: April 2024

National Public Data Breach

In late December 2023, a cybercriminal group identified as USDoD breached the systems of National Public Data (NPD), a company known for aggregating public information for background checks. The breach, discovered in April 2024, has potentially exposed sensitive personal information of millions of individuals. The breach made headlines as having exposed "3 billion people" due to a breach of the National Public Data background check service. The initial corpus of data released in the breach contained billions of rows of personal information, including US social security numbers.

This is not directly related to any U of I service. This notice is being published as a public service because the broad nature of breach.

The Scope of the Breach

The attackers accessed and potentially leaked 2.9 billion records, which include:

• Social Security numbers,
• names,
• addresses,
• email addresses, and
• phone numbers.

This data has been offered for sale on the dark web, raising significant concerns about identity theft and fraud.

Impact on Individuals

The compromised data can be used for various malicious activities, including identity theft, financial fraud, and phishing attacks. Individuals whose information was exposed are at a heightened risk and should take immediate steps to protect themselves.

We are following the situation with our vendors and will update this page as they provide more information. We are aware of 44 individuals associated with U of I, but only because their university email address was exposed. Likely many more U of I personnel are affected.

Recommendations

• Read any notices you receive carefully to be sure they are legitimate, and what data is affected. If you are unsure if the letter is legitimate, search for the company online and call their customer service line to verify.
• Monitor your credit report for suspicious changes. You can use a third party service for this, such as one through the Voluntary Benefits program, or this may be available at no cost through your financial institution.
• Consider placing a credit freeze with major credit bureaus to prevent new accounts from being opened in your name.
   

This is also a good reminder of the importance of cybersecurity. You can protect yourself and others by taking the following steps:

• Change passwords for online accounts, especially those that use the same credentials as your NPD account. Use unique passwords everywhere and use a password manager.
• Protect all your online accounts by enabling Mult-Factor Authentication (MFA) when available.
• Be suspicious of requests for personal data, and report suspicious or phish messages to OIT, or your email provider.
• If your identity is stolen, use the resources available.

Resources and Support

• University of Idaho: What do I do if my identity is stolen?
• Credit Monitoring Services: Enroll in a credit monitoring service to receive alerts about suspicious activity.
  • Experian: www.experian.com
  • Equifax: www.equifax.com
  • TransUnion: www.transunion.com
     
• Identity Theft Protection: Consider subscribing to an identity theft protection service for additional security.
• Contact Information: For further assistance, individuals can contact NPD’s support team or visit their website for more information.
  • National Public Data Support Team:
    • Address: 1440 Coral Ridge Dr. #236, Coral Springs, FL 33071, USA
    • Phone: 800-630-1790
    • Website: National Public Data

References:
House Oversight Release: National Public Data breach
CBS News: National Public Data breach
USA News: National Public Data breach