National Public Data: What the 2.9 Billion-Record Breach Actually Means

The Breach Behind the 2.9 Billion-Record Number In 2024, National Public Data became the center of a major data-breach story after databases attributed to the background-check company were offered and circulated online. The headline number — 2.9 billion records — should not be read as 2.9 billion individual people. A large database can contain multiple records for the same person, and reporting on the incident used different estimates for unique records and affected individuals. Watch: The National Public Data Breach Explained In April 2024, a hacker using the name USDoD was reported to have offered a National Public Data database for sale for millions of dollars. Subsequent reporting documented additional copies and claims about the material being circulated. The important point is not the headline alone: National Public Data held highly sensitive information that can be useful for identity theft, impersonation, phishing, and other fraud. What Was Reported as Exposed Coverage of the incident described combinations of personally identifying information such as: Data Type / Examples reported Names / Names and aliases Social Security numbers / Large-scale SSN exposure was reported Addresses / Current and historical addresses Phone numbers / Numbers associated with records Dates of birth / Information useful for identity verification and fraud Family relationships / Relatives associated with records The exact scope varies by dataset and by source. Treat the figures as estimates tied to particular database dumps, not a precise count of unique victims. Why the Story Matters National Public Data assembled information from public-record and other data sources for background-check services. That creates a familiar privacy problem: information can be technically obtainable somewhere and still be highly sensitive when aggregated into one profile. You may never have created an account with a background-check company and still have information about yourself in its databases. The incident is a reminder that deleting an account is not the same thing as deleting every copy of information associated with you. Timeline Period / Reported development Early 2024 / National Public Data records were reported in underground forums and offered for sale. August 2024 / Major public reporting described the scale of the exposure. Late 2024 / The company faced lawsuits and severe financial pressure after the incident. The public record contains multiple datasets and competing estimates, so a single timeline should not be treated as proof that every exposed record appeared at the same moment. The Aftermath The fallout included lawsuits, consumer warnings, and efforts to determine which records belonged to which people. The most important practical problem is persistence: once personal information is copied, redistributing it is difficult to reverse. A compromised password can be changed. A Social Security number is much harder to replace, which makes long-lived identity data especially consequential. What You Can Do Now Protect the accounts that matter most Turn on multi-factor authentication for email, banking, and other important accounts. Use unique passwords instead of reusing one password across multiple services. Keep recovery email addresses and phone numbers up to date. Check password exposure Our Password Exposure tool checks whether a password appears in known breach data without asking you to submit the password to a remote database. It is a password check — it does not determine whether your email address appears in the National Public Data dataset. Monitor financial identity signals Review your credit reports for unfamiliar activity. Consider a credit freeze or fraud alert where appropriate. Be cautious with calls, texts, and emails that use real personal details to appear legitimate. Reduce your public footprint Use our Data Broker Opt-Out tool to work through common people-search and data-broker removal requests. The Important Distinction The 2.9-billion figure is a database headline, not a headcount. Some records can refer to the same person, and different dumps can overlap. What is not really in dispute is the underlying privacy lesson: when a company aggregates identity information at large scale, a breach can expose a profile that is far more useful to an attacker than any single public record. That is why the most useful response is layered: secure your important accounts, monitor for identity fraud, reduce unnecessary data exposure, and assume that information already leaked online may be difficult to fully retract.