2.9 billion hit in one of the largest data breaches ever — full names, addresses and SSNs exposed

Comments

• Telorand@reddthat.com ⁨3⁩ ⁨months⁩ ago

  A complaint submitted to the US District Court for the Southern District of Florida claims the exposed personal data belongs to a public records data provider named National Public Data, which specializes in background checks and fraud prevention.

  What’s with these companies nobody has heard of causing massive fuck ups?

  source

  • db2@lemmy.world ⁨3⁩ ⁨months⁩ ago

    It’s capitalism. Do you hate America or something?

    source
  • Telodzrum@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Because companies you’ve never heard of are the ones doing the infrastructure and data warehousing for the public-facing companies you have heard of.

    source

    • Telorand@reddthat.com ⁨3⁩ ⁨months⁩ ago

      Seems like a good way to have an infosec weak spot…oh…

      source
• grte@lemmy.ca ⁨3⁩ ⁨months⁩ ago

  The personal data of 2.9 billion people, which includes full names, former and complete addresses going back 30 years, Social Security Numbers, and more, was stolen from National Public Data by a cybercriminal group that goes by the name USDoD. The complaint goes on to explain that the hackers then tried to sell this huge collection of personal data on the dark web to the tune of $3.5 million. It’s worth noting that due to the sheer number of people affected, this data likely comes from both the U.S. and other countries around the world.

  What makes the way National Public Data did this more concerning is that the firm scraped personally identifiable information (PII) of billions of people from non-public sources. As a result, many of the people who are now involved in the class action lawsuit did not provide their data to the company willingly.

  What exactly makes this company so different from the hacking group that breached them? Why should they be treated differently?

  source

  • ricecake@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

    I feel like that might be bad phrasing on the part of the article. They mainly aggregate public records, like legal document style public records, and they also scrapped data from not-(public record) data, which isn’t the same as (not-public) record data.

    I feel like I would want more details to be sure though, but scrapping usually refers to “generally available” data.

    source

    • fmstrat@lemmy.nowsci.com ⁨3⁩ ⁨months⁩ ago

      That all depends. If they’re pulling that private data for use in questionnaires, the terms may not allow them to save it, but they scrape it from the form.

      source

      • -> View More Comments
  • jaybone@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Same with the big three credit reporting bureaus Equifax and whoever the fuck. Did anyone ever give them permission to horde all of their personal info? I don’t think so.

    source
  • fmstrat@lemmy.nowsci.com ⁨3⁩ ⁨months⁩ ago

    All depends on the terms of use from those that provide the data to them that they scraped from. I bet they never expected a customer to do it.

    source
• Fredselfish@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Oh well I feel at this point every man woman and child already had this done to them in United States and our government not doing shit about it.

  source

  • thesohoriots@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Stack on another “Free monitoring, 2 years”

    source

    • Lifecoach5000@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Just got this bullshit offer from Ticketmaster for one of their breaches and they are only offering 1 year free credit monitoring.

      source

      • -> View More Comments
    • frezik@midwest.social ⁨3⁩ ⁨months⁩ ago

      If I get to use them consecutively, I’m good for a few lifetimes.

      source
    • lolola@lemmy.blahaj.zone ⁨3⁩ ⁨months⁩ ago

      What if this was just a scheme to get everyone free monitoring

      source

      • -> View More Comments
    • tritonium@midwest.social ⁨3⁩ ⁨months⁩ ago

      Put a credit freeze on all 3 credit agencies.

      source
  • fmstrat@lemmy.nowsci.com ⁨3⁩ ⁨months⁩ ago

    This one is way more than just the US.

    source
  • SteveFromMySpace@lemmy.blahaj.zone ⁨3⁩ ⁨months⁩ ago

    I get a mailer probably every quarter

    source

    • KnightontheSun@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Hi Steve. Have you heard from Tom? Been a while.

      source

      • -> View More Comments
• Spotlight7573@lemmy.world ⁨3⁩ ⁨months⁩ ago

  With a breach of this size, I think we’re officially at the point where the data about enough people is out there and knowledge based questions for security should be considered unsafe. We need to come up with different authentication methods.

  source

  • fmstrat@lemmy.nowsci.com ⁨3⁩ ⁨months⁩ ago

    Private keys for everyone.

    source

    • zer0squar3d@lemmy.dbzer0.com ⁨3⁩ ⁨months⁩ ago

      You get a private key! And you get a private key! And you get a private key!

      source

      • -> View More Comments
  • floofloof@lemmy.ca ⁨3⁩ ⁨months⁩ ago

    We have different authentication methods. The hard bit is persuading people to use them.

    source

    • Spotlight7573@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Before people can be persuaded to use them, we have to persuade or force the companies and sites to support them.

      source
  • QuarterSwede@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Passkeys. They’re amazing.

    source

    • ag10n@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Typing a password to a browser or device isn’t going to make it any easier. Use a password manager and set unique string passwords for everything. If the app supports it, use FIDO physical keys instead of Passkeys

      source

      • -> View More Comments
    • fmstrat@lemmy.nowsci.com ⁨3⁩ ⁨months⁩ ago

      Until you realize Apple allows the iPhone to airdrop them. Ugh.

      source
  • Uli@sopuli.xyz ⁨3⁩ ⁨months⁩ ago

    Pirate keys for sure. Not using one is just asking for a stranger to grab your booty.

    source

    • scottmeme@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

      I want a stranger to grab my ass sometime

      source
    • ThePantser@lemmy.world ⁨3⁩ ⁨months⁩ ago

      But I enjoy a booty grabbing.

      source
    • dexterous@programming.dev ⁨3⁩ ⁨months⁩ ago

      Pirate keys for sure.

      Arrr… SA to ye all!

      source
  • NotMyOldRedditName@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Start using Yubikeys

    source
• Treczoks@lemmy.world ⁨3⁩ ⁨months⁩ ago

  And again they will fail to punish the company responsible for protecting this data for their criminal neglience.

  source

  • Thebeardedsinglemalt@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Because that might damage shareholder value

    source

    • Treczoks@lemmy.world ⁨3⁩ ⁨months⁩ ago

      It really should. The shareholders did profit from not investing in security until the incident. Let them suffer.

      source
• aesthelete@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Any company accumulating, aggregating, and centralizing every piece of private and public under the sun about people is a ticking time bomb.

  We need harsher penalties for these assholes, and a privacy amendment so that we actually have some rights when dealing with them.

  source

  • DarkCloud@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Also, from a national security perspective we need to make sure this isn’t ONLY happening to that English speaking world, and that it’s also happening in places like Russia and China.

    source
• Confused_Emus@lemmy.dbzer0.com ⁨3⁩ ⁨months⁩ ago

  Go ahead, steal my identity. See if you have any better luck with it.

  I keep all my credit reports frozen. These days, everyone should.

  source

  • fmstrat@lemmy.nowsci.com ⁨3⁩ ⁨months⁩ ago

    Keep in mind there are 4 providers now, not 3!

    source

    • Confused_Emus@lemmy.dbzer0.com ⁨3⁩ ⁨months⁩ ago

      Oh? Who’s the new one?

      source

      • -> View More Comments
• CallateCoyote@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Dang, that’s quite a few people. Maybe we can stop linking our identity to a simple number in the US sometime? That would be swell.

  source

  • Alexstarfire@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Image

    source
• xthexder@l.sw0.com ⁨3⁩ ⁨months⁩ ago

  How did this company leak 2.9 billion people’s info, including SSNs, when the population of the US is only ~350M?

  Is “National Public Data” collecting info on everyone internationally? So many questions…

  source

  • CluelessLemmyng@lemmy.sdf.org ⁨3⁩ ⁨months⁩ ago

    When applying to a US government position with a certain security clearance, they will do background checks of you, your family and extended family, if need be.

    And I’m sure that can be the case for any employer who needs background checks. That being said, I also suspect some of these people in the database are dead.

    source
  • fmstrat@lemmy.nowsci.com ⁨3⁩ ⁨months⁩ ago

    Read the article? Your questions are answered there.

    source
• ClanOfTheOcho@lemmy.world ⁨3⁩ ⁨months⁩ ago

  It sounds like a bad breach, and I’m not arguing against that. I just want to point out my doubts that there were ever 2.9 billion Americans since the founding of the nation, let alone since social security numbers became a thing. Maybe if I bothered to read the article, it would make more sense.

  source

  • my_hat_stinks@programming.dev ⁨3⁩ ⁨months⁩ ago

    Okay, but I’m not sure how revelant that is. The article doesn’t say only Americans were affected, it says the exact opposite.

    […] this data likely comes from both the U.S. and other countries around the world.

    source

    • ClanOfTheOcho@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Like I said, I didn’t read the article, but only Americans would have social security numbers.

      source

      • -> View More Comments
  • captain_aggravated@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

    There’s something like 330 million Americans currently alive, give or take. Social Security began in 1935, so that’s 89 years ago. For the sake of making the math easy for a dumb Lemmy comment, let’s figure the population at the time was two thirds of what it is today at 220 million, and we can figure that within the margin of error virtually all of them are dead. Yes there are some Americans between the ages of 90 and 111 but they likely didn’t have social security numbers as children; the practice of assigning a SSN at birth happened later when they tied it to a tax credit for having kids; at first you got a SSN when you got your first job so anyone who was under the age of 15 or so in 1935 wouldn’t have been given one.

    So let’s figure 220 million Americans who have since died, and 330 Americans who are still alive, have held social security numbers. That’s 550 million SSNs total. Rough back of the napkin math.

    source

    • Alexstarfire@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Why guess at the 1935 pop instead of just looking it up?

      It was about 127 million.

      source

      • -> View More Comments
    • mctoasterson@reddthat.com ⁨3⁩ ⁨months⁩ ago

      The SSN itself is limited to under 1 billion possible permutations anyway because the format is 9 total digits. (3 digits hyphen 2 digits hyphen 4 digits.)

      And if I recall they also have something weird with the state you were born roughly corresponding to which 3 digit prefix you’re issued. Obviously that isn’t purely true either because that would only give you about 1 million unique numbers per prefix.

      Either way they’ve gotta be close to the theoretical maximum of the format without recycling numbers.

      source
  • jabathekek@sopuli.xyz ⁨3⁩ ⁨months⁩ ago

    Lol, yeah “National Public Data” has records of over 3 billion people going back 30 years and these people live all over the world, so it seems.

    source
• _sideffect@lemmy.world ⁨3⁩ ⁨months⁩ ago

  “Please enter your full name, address and SSN to check if you were exposed!”

  source
• solrize@lemmy.world ⁨3⁩ ⁨months⁩ ago

  There are only 1 billion SSNs possible with 9 digits, and at most around 350M living people who have them (the US population). This breach is international but SSN is a US thing.

  source

  • JohnEdwa@sopuli.xyz ⁨3⁩ ⁨months⁩ ago

    Social security number specifically might be, but a unique number tied to you that is often used as identification when it really shouldn’t isn’t, it’s a shitshow that has been implemented in many countries around the world. en.wikipedia.org/…/National_identification_number

    source
  • floofloof@lemmy.ca ⁨3⁩ ⁨months⁩ ago

    And not all 9-digit numbers are used, so there are fewer than a billion.

    source

    • prime_number_314159@lemmy.world ⁨3⁩ ⁨months⁩ ago

      A lot of businesses use the last 4 digits separately for some purposes, which means that even if it’s salted, you are only getting 110,000 total options, which is trivial to run through.

      source
  • catloaf@lemm.ee ⁨3⁩ ⁨months⁩ ago

    Do TINs overlap with SSNs? Because businesses and non-citizen taxpayers have TINs instead of SSNs, but they’re used just the same.

    source

    • solrize@lemmy.world ⁨3⁩ ⁨months⁩ ago

      This I don’t know. I remember reading that around 70%(?) of SSNs have been allocated, and there are enough left for a few decades. No idea whether corporation TINs come from that. I believe non-citizen taxpayers get similar SSNs to citizens. IDK if they pay into social security and collect benefits the same way.

      source
• Doxatek@mander.xyz ⁨3⁩ ⁨months⁩ ago

  I like how my social security card explicitly says not to be for identification and tax purposes only. But I need for absolutely fucking everything and to identify I’m a citizen. Can hardly sign up for a new email without a SSN. (Exaggerating of course about the email)

  source

  • qjkxbmwvz@startrek.website ⁨3⁩ ⁨months⁩ ago

    to identify I’m a citizen.

    It’s kinda worse than that — it’s used to authenticate yourself as a citizen.

    My SSN should at most be an ID, no different from a name. I can identify myself as Darth Vader or 4200-69-1337, but that shouldn’t matter, because I should never be able to authenticate myself as either of those.

    source

    • StreetCash@lemm.ee ⁨3⁩ ⁨months⁩ ago

      I think you miss typed a number, that one doesnt seem to be working

      source
• BingBong@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

  Identity theft monitoring services always scare me. It seems like you are dumping a huge amount of information into a single system and just hoping the vendor is secure. I have access to one but refuse to put much information in. Is this mindset incorrect?

  source

  • AnarchistArtificer@slrpnk.net ⁨3⁩ ⁨months⁩ ago

    It reminds me of the recent Crowdstrike fiasco: apparently kernel level access was needed for their anti-malware to be able to properly work (because that way their net can cover the entire OS basically), but that high level of access meant that when CrowdStrike fucked up with an update, people’s computers were useless. (Disclaimer, I am not a cybersecurity person and am not offering judgement either way on whether Crowdstrike’s claim about kernel level access was bullshit or not)

    In a similar way, in order for identity theft monitoring services to work, they surely will need to hold a heckton of data about you. This is fine if they can be trusted to hold that data securely, but otherwise… ¯\_ (ツ)_/¯

    I share your unease, though I don’t feel able to comment on the correctness of your mindset. Though I will say that on an individual level, keeping an eye on your credit reports in general (from the major credit agencies) will go a long way to helping there (rather than paying for serviced that give you a score and other fancy “features”, you can request either free or v. low cost report which just has the important stuff you need to know.)

    I also know that if you want to be extra cautious, you can manually freeze your credit so basically no new lines of credit can be opened in your name. This is most useful for people who have already been a victim of fraud, or they expect to be at risk (such as by shitty family, or a data breach). I don’t know how one sets this up, but I know that if you did want to set up a new line of credit, you can call to unfreeze your credit, and then freeze it again when your application for the new credit is all done. I have a friend who has had this as their default for years now because of shitty family.

    source

    • TwitchingCheese@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Yea that’s a tough system to design for. Ideally you want sensitive stuff like that, where you don’t care what the data is just that something matches it, stored as the results of a one-way hash function.

      The problem is that most of the data you’re going to want to secure is pathetically tiny. 10 digit SSN? My phone can brute force that in a few minutes if you’re doing raw hashes. Gotta salt them. But now you have a tradeoff decision, salting every one uniquely is best but now your comparison needs to do [leaked data] × [customers] checks to find matches. Same salt on all of them and as soon as one is cracked they all are.

      source
• NutWrench@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Who TF is “National Public Data?”

  source

  • Nurgus@lemmy.world ⁨3⁩ ⁨months⁩ ago

    A company not dumb enough to store anything in the EU, that’s who. They’d be in real trouble now! Phew.

    source

    • unrelatedkeg@lemmy.sdf.org ⁨3⁩ ⁨months⁩ ago

      You’re kidding, right?

      source
• pineapplelover@lemm.ee ⁨3⁩ ⁨months⁩ ago

  I tried freezing my credit but I think transunion and equifax wouldn’t let me create an account for some reason. Asking me to call them. Anybody else running into the same issue?

  source

  • return2ozma@lemmy.world ⁨3⁩ ⁨months⁩ ago

    I know Ticketmaster just sent out millions of “sorry we got hacked, freeze your credit for free with this code” letters. Maybe they’re struggling to keep up with demand.

    source

    • pineapple_pizza@lemmy.dexlit.xyz ⁨3⁩ ⁨months⁩ ago

      Mine was for credit monitoring. You should be able to freeze your credit for free at any time

      source
  • ohlaph@lemmy.world ⁨3⁩ ⁨months⁩ ago

    I did previously and had to wait until a weekday to talk to someone. It was a huge pain. Fuck those agencies.

    source

    • cm0002@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Fuck those companies, they’d prefer that you thought of them as agencies because it makes them appear to be at list affiliated with the government.

      They’re not, they are private companies through and through

      source
  • UselesslyBrisk@infosec.pub ⁨3⁩ ⁨months⁩ ago

    Are you proxying or using a VPN to access their site. I often see IP blocks, even if that proxy is a simple socks proxy to a VPS i own. Many VPS subnets are blocked/restricted wholesale, as are many of the big VPN endpoint ips.

    source

    • pineapplelover@lemm.ee ⁨3⁩ ⁨months⁩ ago

      Yeah I use VPN. Maybe I should jump to random countries or maybe turn it off.

      source

      • -> View More Comments
• PenisDuckCuck9001@lemmynsfw.com ⁨3⁩ ⁨months⁩ ago

  Good god. Thats like, every person that has ever used a computer. Fuck.

  source
• A_A@lemmy.world ⁨3⁩ ⁨months⁩ ago

  the U.S. and other countries “around the world”

  meaning, for those of us living on other planets, we are completely safe … such a relief ! /s

  source
• C126@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

  2 billion social security numbers? What’s the population of the US?

  source
• MIDItheKID@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Is there a simple way to find out if your Information was in this leak, and what information it is? I use haveibeenpwned for leaks linked to my email address, but from I read in this article, it’s not linked to my email address.

  So how do I found out if my data was leaked without paying for a credit monitoring service?

  source
• werefreeatlast@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Otherwise, how would the republicans get enough votes.

  source
• AWittyUsername@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Is this why I got the latest scam email saying I need to pay $4k in bitcoin else a video of me wanking would be leaked.

  source
• Trainguyrom@reddthat.com ⁨3⁩ ⁨months⁩ ago

  Worth noting looks like this breach was first reported at the start of June

  www.theregister.com/2024/06/03/usdod_data_dump/

  source
• mechoman444@lemmy.world ⁨3⁩ ⁨months⁩ ago

  This explains why I’ve been getting so many Indian scam calls the last few days.

  source