Hackers may have stolen your Social Security number in a massive breach. Here's what to know. (2024)

MoneyWatch

By Aimee Picchi

Edited By Anne Marie Lee

/ CBS News

A new lawsuit is claiming hackers have gained access to the personal information of "billions of individuals," including their Social Security numbers, current and past addresses and the names of siblings and parents — personal data that could allow fraudsters to infiltrate financial accounts or take out loans in their names.

The allegation arose in a lawsuit filed earlier this month by Christopher Hofmann, a California resident who claims his identity theft protection service alerted him that his personal information had been leaked to the dark web by the "nationalpublicdata.com" breach. The lawsuit was earlier reported by Bloomberg Law.

The breach allegedly occurred around April 2024, with a hacker group called USDoD exfiltrating the unencrypted personal information of billions of individuals from a company called National Public Data (NPD), a background check company, according to the lawsuit. Earlier this month, a hacker leaked a version of the stolen NPD data for free on a hacking forum, tech site Bleeping Computer reported.

That hacker claimed the stolen files include 2.7 billion records, with each listing a person's full name, address, date of birth, Social Security number and phone number, Bleeping Computer said. While it's unclear how many people that includes, it's likely "that everyone with a Social Security number was impacted," said Cliff Steinhauer, director of information security and engagement at The National Cybersecurity Alliance, a nonprofit that promotes online safety.

"It's a reminder of the importance of protecting yourself, because clearly companies and the government aren't doing it for us," Steinhauer told CBS MoneyWatch.

In a statement posted to its website, NPD said the breach involved a "third-party bad actor that was trying to hack into data in late December 2023, with potential leaks of certain data in April 2024 and summer 2024."

The company added that it is working with law enforcement and government investigators. NPD said it "will try to notify you if there are further significant developments applicable to you."

Here's what to know about the alleged hack.

What is National Public Data?

National Public Data is a data company based in Coral Springs, Florida, that provides background checks for employers, investigators and other businesses that want to check people's backgrounds. Its searches include criminal records, vital records, SSN traces and more information, its website says.

There are many similar companies that scrape public data to create files on consumers, which they then sell to other businesses, Steinhauer said.

"They are data brokers that collect and sell data about people, sometimes for background check purposes," he said. "It's because there's no national privacy law in the U.S. — there is no law against them collecting this data against our consent."

What happened with the USDoD hack?

According to the new lawsuit, USDoD on April 8 posted a database called "National Public Data" on the dark web, claiming to have records for about 2.9 billion individuals. It was asking for a purchase price of $3.5 million, the lawsuit claims.

However, Bleeping Computer reported that the file was later leaked for free on a hacker forum, as noted above.

How many people have been impacted?

The number of people impacted by the breach is unclear. Although the lawsuit claims "billions of individuals" had their data stolen, the total population of the U.S. stands at about 330 million. The lawsuit also alleges that the data includes personal information of deceased individuals.

Bleeping Computer reports that the hacked data involves 2.7 billion records, with individuals having multiple records in the database. In other words, one individual could have separate records for each address where they've lived, which means the number of impacted people may be far lower than the lawsuit claims, the site noted.

The data may reach back at least three decades, according to law firm Schubert Jonckheer & Kolbe, which said on Monday it is investigating the breach.

Did NPD alert individuals about the hack?

It's unclear, although the lawsuit claims that NPD "has still not provided any notice or warning" to Hoffman or other people affected by the breach.

"In fact, upon information and belief, the vast majority of Class Members were unaware that their sensitive [personal information] had been compromised, and that they were, and continue to be, at significant risk of identity theft and various other forms of personal, social, and financial harm," the lawsuit claims.

Information security company McAfee reported that it hasn't found any filings with state attorneys general. Some states require companies that have experienced data breaches to file reports with their AG offices.

However, NPD posted an alert about the breach on its website, stating that it believes the information breached includes names, email addresses, phone numbers, Social Security numbers and mailing addresses.

Can you find out if your data was part of the hack?

There are tools available that will monitor what information about you is available on the dark web, noted Michael Blair, managing director of cybersecurity firm NukuDo. Commonly breached data includes your personal addresses, passwords and email, he added.

One such service is how Hofmann, who filed the lawsuit, found out that his information has been leaked as part of NPD breach.

"Make sure to use reputable companies to look that up," Blair said.

What should I do to protect my information?

Security experts recommend that consumers put freezes on their credit files at the three big credit bureaus, Experian, Equifax and TransUnion. Freezing your credit is free, and will stop bad actors from taking out loans or opening credit cards in your name.

"The biggest thing is to freeze your credit report, so it can't be used to open new accounts in your name and commit other fraud in your name," Steinhauer said.

Steinhauer recommends consumers take several additional steps to protect their data and finances:

  • Make sure your passwords are at least 16 characters in length, and are complex.
  • Use a password manager to save those long, complex passwords.
  • Enable multifactor authentication, which Steinhauer calls "critical," because simply using a single password to access your accounts isn't enough protection against hackers.
  • Be on alert for phishing and other scams. One red flag is that the scammers will try to create a sense of urgency to manipulate their victims.
  • Keep your security software updated on your computer and other devices. For instance, make sure you download the latest security updates from Microsoft or Apple onto your apps and devices.

You can also get a tracking service that will alert you if your data appears on the dark web.

"You should assume you have been compromised and act accordingly," Steinhauer said.

    In:
  • Data Breach
  • Social Security

Aimee Picchi

Aimee Picchi is the associate managing editor for CBS MoneyWatch, where she covers business and personal finance. She previously worked at Bloomberg News and has written for national news outlets including USA Today and Consumer Reports.

Hackers may have stolen your Social Security number in a massive breach. Here's what to know. (2024)

FAQs

What do I do if my Social Security number was breached? ›

What to do if you suspect your Social Security number has been stolen
  1. Visit IdentityTheft.gov to make a report and get a recovery plan. ...
  2. File a police report and keep a copy for your records in case problems arise in the future.
  3. File an online report with the Internet Crime Complaint Center (IC3) at ic3.gov.
3 days ago

What to do if someone steals your Social Security number? ›

www.irs.gov/uac/Identity-Protection

or call 1-800-908-4490. Also, you should file an online complaint with the Internet Crime Complaint Center (IC3) at www.ic3.gov.

How do I lock my Social Security number? ›

If you know your Social Security information has been compromised, you can request to Block Electronic Access. This is done by calling our National 800 number (Toll Free 1-800-772-1213 or at our TTY number at 1-800-325-0778).

How do you see if your Social Security number is being used? ›

Check your credit reports for fraudulent loans and accounts
  1. Order your credit reports. All Americans are entitled to receive free credit reports from each of the three credit bureaus — Equifax, Experian, and TransUnion. ...
  2. Verify personal information. ...
  3. Examine accounts and payment histories.

How do you put a flag on your Social Security number? ›

How to put a flag on your social security number or credit report
  1. Contact one of the three credit reporting agencies (Transunion, Equifax, or Experian). ...
  2. After a few days, check with the other two credit bureaus to verify that they've received the fraud alert as well.
Aug 12, 2023

How do you put a PIN on your Social Security number? ›

How to get an IP PIN. The fastest way to receive an IP PIN is to request one through your online account. If you don't already have an account on IRS.gov, you must register to validate your identity. Spouses and dependents are eligible for an IP PIN if they can pass the identity verification process.

How much does it cost to change your Social Security number? ›

There is no charge for correcting your Social Security card or getting one for the first time.

How do I check to see if someone is using my identity? ›

Here are six simple ways to check for identity theft:
  1. Review your credit reports.
  2. Check your bank statements.
  3. Pay attention to strange mail.
  4. Stay on top of your tax returns.
  5. Check your medical statements.
  6. Review your Social Security statements.
Jun 3, 2024

Can I change my Social Security number? ›

You can do this by contacting the SSA at 1-800-772-1213 or their teletypewriter number at 1-800-325-0778. Getting a new Social Security number is challenging but possible. You must have a valid reason for the change and provide documentation to prove it.

How much does it cost to lock your Social Security number? ›

There is NO COST to place or lift a security freeze. For more information, see detailed instructions entitled “Placing a Security Freeze on Your Credit Report to Protect Yourself from Identity Theft” below. 5. Review your credit reports carefully.

How to freeze your Social Security number online for free? ›

To sign up for Self Lock and freeze your SSN:
  1. Go to myE-Verify and follow the prompts to create an account. ...
  2. After you create the account, you'll take a short Identity Proofing quiz.
  3. Next, you'll land in your myE-Verify dashboard. ...
  4. Click Lock My SSN.
  5. Set your Self Lock challenge questions.

What are three warning signs of identity theft? ›

Beware of these warning signs:
  • Bills for items you did not buy.
  • Debt collection calls for accounts you did not open.
  • Information on your credit report for accounts you did not open.
  • Denials of loan applications.
  • Mail stops coming to or is missing from your mailbox.
May 3, 2024

What happens if someone steals your Social Security number? ›

One of the strongest validation for someone's identity, Social Security numbers (SSNs) are highly valuable for identity thieves. With a stolen SSN, criminals can open new lines of credit, file taxes under your name, or even fraudulently apply for your government benefits.

What to do if a scammer has your Social Security number? ›

Submit a Social Security fraud report

If your SSN has been fraudulently used, the Social Security Administration's Office of the Inspector General (SSA OIG) can investigate on your behalf. You can contact the SSA OIG's hotline at 1-800-269-0271 or submit a claim online.

Can I check if my SSN is active? ›

Go to the website for the social security administration, ssa.gov, and follow the links to the Social Security Number Verification System (SSNVS).

What to do if your Social Security number is phished? ›

What to Do if You Were Scammed
  1. Do not blame yourself. ...
  2. Stop contact with the scammer. ...
  3. Notify the three major credit bureaus: Equifax, Experian, and TransUnion to add a fraud alert to your credit report.
  4. Protect your Social Security Number.
  5. Request a replacement SSN card or new SSN, if necessary.
Dec 5, 2019

What to do if your identity has been breached? ›

File a Report With the Federal Trade Commission

To file a report with the FTC, visit www.identitytheft.gov. As part of the reporting process, you'll receive a recovery plan and even prefilled letters and forms you can use to file police reports and dispute fraudulent charges.

What to do if you get a call saying your SSN was compromised? ›

It is a scam! Phone scammers may send official-looking letters or reports by U.S. mail, email, text, or social media message to convince you they are legitimate. The letters may appear to be from SSA or SSA OIG, with official letterhead and government jargon. They may also contain misspellings and typos.

Top Articles
Latest Posts
Recommended Articles
Article information

Author: Kieth Sipes

Last Updated:

Views: 5693

Rating: 4.7 / 5 (67 voted)

Reviews: 90% of readers found this page helpful

Author information

Name: Kieth Sipes

Birthday: 2001-04-14

Address: Suite 492 62479 Champlin Loop, South Catrice, MS 57271

Phone: +9663362133320

Job: District Sales Analyst

Hobby: Digital arts, Dance, Ghost hunting, Worldbuilding, Kayaking, Table tennis, 3D printing

Introduction: My name is Kieth Sipes, I am a zany, rich, courageous, powerful, faithful, jolly, excited person who loves writing and wants to share my knowledge and understanding with you.