The NPD breach, one of the most significant cybersecurity incidents in history, exposed the personal data of nearly three billion people, including Social Security numbers, addresses and email addresses. A cybercriminal group carried out the breach called “USDoD,” which claimed responsibility for the attack. The breach occurred in December 2023 but was only confirmed by the National Public Data (NPD), a data broker that collects information from public sources for background checks, in August 2024. The NPD also admitted that it had accidentally published its own passwords online, making the breach worse.
The breach has sparked outrage and concern among the public, lawmakers and experts, who have criticized the NPD for its lack of transparency, accountability and security. The NPD is facing a lawsuit from a consumer advocacy group, which accuses the company of violating the privacy rights of millions of Americans. The breach has also raised questions about the adequacy of the U.S. laws and regulations that govern personal data collection, use and protection, especially by data brokers that operate with minimal oversight and disclosure. The breach has also exposed the vulnerability of the consumers, who may not be aware of how their data is collected, stored and shared, and who may face the risk of identity theft, fraud and scams.
Several cybersecurity experts from different companies have shared their insights and opinions on the NPD breach and its implications. Clyde Williamson from Protegrity emphasized the need for organizations to protect the data they exchange with consumers and comply with privacy laws. He also pointed out the inadequacy of U.S. laws in handling citizens’ personal data and the need for regulatory standards for data brokers. Kiran Chinnagangannagari from Securin expressed alarm over the silence of the NPD until the breach included leaked social security numbers. He also stressed the need for organizations to evaluate and ensure the cybersecurity practices of their partners and third-party vendors. Ayan Hadler from Traceable AI suggested using intent-driven risk management, which looks at how users behave after getting onto the platform and what they are going after, to reduce the risks posed by weak KYC measures.
Clyde Williamson, Product Management, Innovations, Protegrity
“Organizations rely on the exchange of data for their vitality. Consumers share their personal identifiable information (PII), like Social Security numbers and emails, with the expectation that businesses will protect this data and comply with privacy laws to prevent unauthorized access. In this case, National Public Data (NPD) scraped individuals’ PII from public sources for use in background checks, leaving people unaware if their data was accessed and emphasizing growing concerns regarding customer trust in businesses and their ability to secure their data.
Notably, this breach wasn’t announced for a week; it only came to light and led to a lawsuit earlier because the company didn’t disclose it. Further, it’s still unclear whether they intentionally avoided sharing details of this breach or just discovered it themselves. This highlights the inadequacy of U.S. laws in handling citizens’ personal data, which are not equipped for the challenges of the 21st century. Data brokers like the NPD also aren’t held to the same regulatory standards as institutions like the Payment Card Industry (PCI), where they’re obligated to conduct annual audits and controls around credit card data. As things stand now, the US has no such obligations.
Most likely, a lot of the stolen data set is from one of our most vulnerable demographics: senior citizens and their families. A popular scam has a threat actor pretending to be a lawyer with bad news for the senior – their family member is in trouble and needs money. And why wouldn’t a grandparent believe them if they had valid PII to validate their credibility? These scammers don’t have to open credit in someone’s name to ruin lives. They just need to know how to use the information stolen to empty a caring family member’s bank account.
As breaches and attack surfaces continue to grow, relying on class action lawsuits for negligence cannot be the best option. Organizations must prioritize transparency and enhance their efforts to de-identify sensitive data to protect consumer information. They must move beyond traditional defense mechanisms and adopt regulator-recommended data protection strategies like encryption and tokenization. These methods render data useless to attackers, making it impossible to steal and use maliciously. By implementing these protections, businesses can diminish the value of stolen data and mitigate the long-term effects of ransomware attacks or fraudulent activities.”
Kiran Chinnagangannagari, Chief Product & Technology Officer, Securin
“In the wake of the staggering National Public Data breach, which compromised millions of records on U.S. citizens, the silence from the company until the breach included leaked social security numbers is nothing short of alarming. This breach underscores the profound risks posed by mass data aggregation and sheds a harsh light on the glaring gaps in corporate responsibility when managing and communicating such incidents. The fact that such enormous volumes of personal data are accessible to companies and private investigators, and now the deep and dark web, raises severe doubts about how well-protected our information truly is. This breach lays bare the minimal oversight over who gains access to this data—and what happens afterward.
This breach should also serve as a wake-up call, emphasizing the critical need for organizations to rigorous or stricter regulations and better enforcement. Companies must be held accountable, not just for evaluating the cybersecurity practices of their partners and third-party vendors. It’s no longer enough to trust that data handlers have robust defenses—organizations must proactively ensure that every entity in their supply chain is equipped to prevent such catastrophic breaches. It’s time for their cybersecurity practices but for those of every entity they do business with. The stakes are too high to allow this negligence to continue.”
Ayan Hadler, Sr. Product Manager, Traceable AI
“When fraudsters have access to key personal details needed to bypass KYC on nearly all American consumers, the question is who to trust anymore? This is where intent-driven risk management shines. Intent-driven risk management looks at how users are behaving “after” getting onto the platform and what are they going after, negating a lot of the risks injected through brittle KYC measures.”
Ad