National Public Data 2024: 2.9 Billion Records Including SSNs Posted on Hacking Forums

Incident summary

National Public Data was the consumer-facing brand of Jerico Pictures Inc., a Coral Springs, Florida data broker that aggregated public-record data including names, addresses, prior residence history, date of birth, family relationships, and Social Security numbers. The company sold access to that dataset for background checks, skip tracing, and people-search applications via its nationalpublicdata.com and recordscheck.net properties. Per the class-action complaint, Jerico Pictures had no consumer-facing relationship with the people in its dataset. Records were aggregated from public sources and third-party data brokers without consumer notification or consent.

Per the Hofmann v. Jerico Pictures complaint filed August 1, 2024 in the Southern District of Florida, threat actor USDoD listed the dataset for sale on BreachForums in April 2024 for $3.5 million. The listing claimed 2.9 billion records covering US, UK, and Canadian residents. A separate actor using the handle Sing released a partial sample in April 2024 confirming SSN inclusion. The full dataset was released for free on a hacking forum in August 2024.

National Public Data acknowledged the breach via a notice on its website in August 2024 attributing initial access to attempts in late December 2023 with leaks in April 2024 and through summer 2024. The company did not file a timely notification with state attorneys general in most jurisdictions. Jerico Pictures Inc. filed Chapter 11 bankruptcy in the Southern District of Florida bankruptcy court on October 1, 2024, listing the breach class-action exposure as the principal cause of insolvency.

Attack technique

Public attribution and technical detail are limited because National Public Data did not publish a root cause analysis and did not retain incident response forensics from a recognized firm. The most credible technique mapping is T1078 (Valid Accounts) for the initial intrusion (the most likely access path given the small operational footprint of the target), T1213 (Data from Information Repositories) for collection from the broker's internal data warehouse, and T1567 (Exfiltration Over Web Service) for bulk transfer of the dataset.

Brian Krebs' August 2024 reporting on the case tied the National Public Data leak to USDoD, a threat actor with a history of public-record-aggregator targeting. Krebs' analysis also surfaced that Jerico Pictures had previously been called out by independent researchers for exposing data via unauthenticated APIs on its recordscheck.net property. The pattern of small data brokers with weak operational security holding large aggregated personal-data datasets is the structural condition. The case study value is not in technique novelty. It is in the business model.

The legal-disclosure technique is also worth noting. Jerico Pictures did not voluntarily disclose the breach in April 2024 when the dataset was first listed for sale. Public exposure came from the class-action complaint filed in August 2024 after the dataset's free release made suppression impossible. State breach-notification statutes typically require notification within 30 to 60 days of discovery, but the discovery date itself is gameable when the data broker is the breach victim. The eventual notification listed late December 2023 as the breach start, more than seven months before any public disclosure.

Impact and consequences

Per the Hofmann v. Jerico Pictures complaint, the dataset contained approximately 2.9 billion records. The class-action complaint estimated approximately 272 million unique individuals affected after deduplication, primarily in the US with smaller UK and Canadian populations. Per Troy Hunt's August 2024 intake of the dataset into Have I Been Pwned, approximately 134 million unique email addresses were confirmed present. The discrepancy between record count and individual count reflects the data broker's product design: each individual had multiple historical address, family, and employment records aggregated into the dataset.

Identity theft and credit-fraud impact is the dominant downstream consequence. Per the FTC's 2024 annual report and Identity Theft Resource Center 2024 quarterly reports, the disclosed SSN-inclusion of the National Public Data leak materially raised the supply of usable SSNs in identity fraud markets. The dataset's free public release in August 2024 made remediation impossible: SSNs cannot be revoked, and the data broker's product was specifically designed to correlate SSN to current address and family relationships, which is the exact data structure that defeats most identity-verification questions used by financial institutions.

Jerico Pictures Inc. filed Chapter 11 bankruptcy on October 1, 2024, listing the class-action exposure as the principal cause of insolvency. The bankruptcy filing valued the company's assets at less than $1 million and listed unliquidated class-action and state regulatory liabilities. Multiple state attorneys general opened investigations in late 2024 under state breach-notification statutes that require timely disclosure. The bankruptcy filing functionally caps individual class-member recovery to a fraction of the underlying claim.

The regulatory consequence is broader than the company itself. The National Public Data case fed congressional and FTC interest in data broker oversight through late 2024. The Consumer Financial Protection Bureau issued a proposed rule in December 2024 to bring data brokers under Fair Credit Reporting Act jurisdiction, citing the National Public Data breach as a specific reason. State-level data broker registration laws in California, Vermont, Oregon, and Texas saw amendment proposals in early 2025 to add minimum-security-standard requirements for registered brokers.

Indicators of Compromise

Specific artifacts defenders should hunt for. Cross-reference these against your existing detection rules before acting on them.

Lessons for defenders

Data broker risk is third-party risk that you cannot mitigate via vendor management. Your customers' data sits in data broker datasets whether or not you have a contract with the broker. Vendor management programs cover contracted vendors. They do not cover data brokers that aggregate from public sources or buy data from other brokers downstream. The defensive posture is to assume that any data point you would treat as an identity verification factor is already in a public dataset.

SSNs are not an authentication factor. The National Public Data leak made this point unavoidable for institutions that still rely on knowledge of SSN as a step in customer identity verification. Move identity verification to verifiable government-issued ID with image and liveness checks, ITIN-equivalent step-up authentication, or out-of-band confirmation through previously-enrolled channels. Knowledge-based authentication using SSN, prior addresses, and family-tree questions is now defeated at scale.

Breach notification timelines are gameable when the breach victim is the data broker. The seven-plus-month gap between the December 2023 breach start and the August 2024 public exposure shows that small private companies can run out the clock on state breach-notification statutes by disputing the discovery date. Defensive programs that depend on receiving timely notification of breaches affecting your customers are misaligned with reality. Operate on the assumption that you will not get timely notification.

Frontline identity-fraud detection beats notification-driven response. Account-opening fraud, credit-application fraud, and synthetic identity fraud are the operational consequences of large SSN-inclusive data broker breaches. Investment in fraud detection model retraining, device fingerprinting, behavioral biometrics, and out-of-wallet authentication on the high-fraud-risk channels (online account opening, credit applications, tax filings) is the practical defense. The October 2024 IRS guidance on identity protection PINs for taxpayers in affected geographies is a related defensive recommendation.

Related career roles

The cybersecurity professionals whose day-to-day work would have detected, investigated, or contained this incident.

• /careers/privacy-engineer
• /careers/grc-analyst
• /careers/data-protection-officer

Related Decipher Files

• Okta Support Breach 2023: 1Password, Cloudflare, BeyondTrust Timeline
• SolarWinds Sunburst: How Supply Chain Compromise Bypassed Every Endpoint Defense

Frequently asked questions