Hackers may have stolen your Social Security number in a massive breach. Here's what to know. (2024)

MoneyWatch

By Aimee Picchi

Edited By Anne Marie Lee

/ CBS News

Lawsuit: Social Security numbers hacked

A new lawsuit is claiming hackers have gained access to the personal information of "billions of individuals," including their Social Security numbers, current and past addresses and the names of siblings and parents — personal data that could allow fraudsters to infiltrate financial accounts or take out loans in their names.

The allegation arose in a lawsuit filed earlier this month by Christopher Hofmann, a California resident who claims his identity theft protection service alerted him that his personal information had been leaked to the dark web by the "nationalpublicdata.com" breach. The lawsuit was earlier reported by Bloomberg Law.

The breach allegedly occurred around April 2024, with a hacker group called USDoD exfiltrating the unencrypted personal information of billions of individuals from a company called National Public Data (NPD), a background check company, according to the lawsuit. Earlier this month, a hacker leaked a version of the stolen NPD data for free on a hacking forum, tech site Bleeping Computer reported.

That hacker claimed the stolen files include 2.7 billion records, with each listing a person's full name, address, date of birth, Social Security number and phone number, Bleeping Computer said. While it's unclear how many people that includes, it's likely "that everyone with a Social Security number was impacted," said Cliff Steinhauer, director of information security and engagement at The National Cybersecurity Alliance, a nonprofit that promotes online safety.

"It's a reminder of the importance of protecting yourself, because clearly companies and the government aren't doing it for us," Steinhauer told CBS MoneyWatch.

In a statement posted to its website, NPD said the breach involved a "third-party bad actor that was trying to hack into data in late December 2023, with potential leaks of certain data in April 2024 and summer 2024."

The company added that it is working with law enforcement and government investigators. NPD said it "will try to notify you if there are further significant developments applicable to you."

Here's what to know about the alleged hack.

What is National Public Data?

National Public Data is a data company based in Coral Springs, Florida, that provides background checks for employers, investigators and other businesses that want to check people's backgrounds. Its searches include criminal records, vital records, SSN traces and more information, its website says.

There are many similar companies that scrape public data to create files on consumers, which they then sell to other businesses, Steinhauer said.

"They are data brokers that collect and sell data about people, sometimes for background check purposes," he said. "It's because there's no national privacy law in the U.S. — there is no law against them collecting this data against our consent."

What happened with the USDoD hack?

According to the new lawsuit, USDoD on April 8 posted a database called "National Public Data" on the dark web, claiming to have records for about 2.9 billion individuals. It was asking for a purchase price of $3.5 million, the lawsuit claims.

However, Bleeping Computer reported that the file was later leaked for free on a hacker forum, as noted above.

How many people have been impacted?

The number of people impacted by the breach is unclear. Although the lawsuit claims "billions of individuals" had their data stolen, the total population of the U.S. stands at about 330 million. The lawsuit also alleges that the data includes personal information of deceased individuals.

Bleeping Computer reports that the hacked data involves 2.7 billion records, with individuals having multiple records in the database. In other words, one individual could have separate records for each address where they've lived, which means the number of impacted people may be far lower than the lawsuit claims, the site noted.

The data may reach back at least three decades, according to law firm Schubert Jonckheer & Kolbe, which said on Monday it is investigating the breach.

Did NPD alert individuals about the hack?

It's unclear, although the lawsuit claims that NPD "has still not provided any notice or warning" to Hoffman or other people affected by the breach.

"In fact, upon information and belief, the vast majority of Class Members were unaware that their sensitive [personal information] had been compromised, and that they were, and continue to be, at significant risk of identity theft and various other forms of personal, social, and financial harm," the lawsuit claims.

Information security company McAfee reported that it hasn't found any filings with state attorneys general. Some states require companies that have experienced data breaches to file reports with their AG offices.

However, NPD posted an alert about the breach on its website, stating that it believes the information breached includes names, email addresses, phone numbers, Social Security numbers and mailing addresses.

Can you find out if your data was part of the hack?

There are tools available that will monitor what information about you is available on the dark web, noted Michael Blair, managing director of cybersecurity firm NukuDo. Commonly breached data includes your personal addresses, passwords and email, he added.

One such service is how Hofmann, who filed the lawsuit, found out that his information has been leaked as part of NPD breach.

"Make sure to use reputable companies to look that up," Blair said.

What should I do to protect my information?

Security experts recommend that consumers put freezes on their credit files at the three big credit bureaus, Experian, Equifax and TransUnion. Freezing your credit is free, and will stop bad actors from taking out loans or opening credit cards in your name.

"The biggest thing is to freeze your credit report, so it can't be used to open new accounts in your name and commit other fraud in your name," Steinhauer said.

In its statement, NPD also urged people to put free fraud alerts on their accounts, which "tells creditors to contact you before they open any new accounts or change your existing accounts," it said. You'll have to contact just one of the three credit bureaus to create a fraud alert, and that agency will alert the others.

Steinhauer recommends consumers take several additional steps to protect their data and finances:

  • Make sure your passwords are at least 16 characters in length, and are complex.
  • Use a password manager to save those long, complex passwords.
  • Enable multifactor authentication, which Steinhauer calls "critical," because simply using a single password to access your accounts isn't enough protection against hackers.
  • Be on alert for phishing and other scams. One red flag is that the scammers will try to create a sense of urgency to manipulate their victims.
  • Keep your security software updated on your computer and other devices. For instance, make sure you download the latest security updates from Microsoft or Apple onto your apps and devices.

You can also get a tracking service that will alert you if your data appears on the dark web.

"You should assume you have been compromised and act accordingly," Steinhauer said.

    In:
  • Data Breach
  • Social Security

Aimee Picchi

Aimee Picchi is the associate managing editor for CBS MoneyWatch, where she covers business and personal finance. She previously worked at Bloomberg News and has written for national news outlets including USA Today and Consumer Reports.

Hackers may have stolen your Social Security number in a massive breach. Here's what to know. (2024)

FAQs

What do I do if my Social Security number was breached? ›

What to do if you suspect your Social Security number has been stolen
  1. Visit IdentityTheft.gov to make a report and get a recovery plan. ...
  2. File a police report and keep a copy for your records in case problems arise in the future.
  3. File an online report with the Internet Crime Complaint Center (IC3) at ic3.gov.
1 day ago

What to do when someone steals your Social Security number? ›

www.irs.gov/uac/Identity-Protection

or call 1-800-908-4490. Also, you should file an online complaint with the Internet Crime Complaint Center (IC3) at www.ic3.gov. The IC3 gives victims of cybercrime a convenient and easy-to-use reporting mechanism that alerts authorities of suspected criminal or civil violations.

How do I lock my Social Security number? ›

This is done by calling our National 800 number (Toll Free 1-800-772-1213 or at our TTY number at 1-800-325-0778). Once requested, any automated telephone and electronic access to your Social Security record is blocked.

How do I check if someone is using my Social Security number? ›

6 Ways To Tell If Someone Is Using Your SSN
  1. Order your credit reports. All Americans are entitled to receive free credit reports from each of the three credit bureaus — Equifax, Experian, and TransUnion. ...
  2. Verify personal information. Scammers may edit profile details. ...
  3. Examine accounts and payment histories.

Can you put a freeze on your Social Security number? ›

Keep in mind that you're not able to "freeze" your SSN, meaning that it can't be used at all. Locking your SSN won't prevent new credit applications. If you want to safeguard against someone else opening credit in your name, you have the right to freeze your credit report with each credit bureau.

How do you put a PIN on your Social Security number? ›

How to get an IP PIN. The fastest way to receive an IP PIN is to request one through your online account. If you don't already have an account on IRS.gov, you must register to validate your identity. Spouses and dependents are eligible for an IP PIN if they can pass the identity verification process.

How much does it cost to change your Social Security number? ›

Social Security Number Services are Always Free

Some businesses offer Social Security name changes or cards for a fee. Social Security provides those services and more for free.

Can I change my Social Security number? ›

You can do this by contacting the SSA at 1-800-772-1213 or their teletypewriter number at 1-800-325-0778. Getting a new Social Security number is challenging but possible. You must have a valid reason for the change and provide documentation to prove it.

Should I call the police if my Social Security number is stolen? ›

If your Social Security number has been stolen, report the identity theft to the Federal Trade Commission and the police, freeze your credit report and contact companies you suspect have your SSN due to fraud.

How much does it cost to lock your Social Security number? ›

There is NO COST to place or lift a security freeze. For more information, see detailed instructions entitled “Placing a Security Freeze on Your Credit Report to Protect Yourself from Identity Theft” below. 5. Review your credit reports carefully.

Can you lock your SSN for free? ›

The Social Security Administration has a free, online tool called Self Lock that lets you immediately stop someone else from using your Social Security number when applying for a job or a new credit account. You can access this feature after setting up an account at Social Security's E-Verity website.

What are three warning signs of identity theft? ›

Beware of these warning signs:
  • Bills for items you did not buy.
  • Debt collection calls for accounts you did not open.
  • Information on your credit report for accounts you did not open.
  • Denials of loan applications.
  • Mail stops coming to or is missing from your mailbox.
May 3, 2024

What should I do if my SSN is stolen? ›

What should I do if my information was stolen? If you notice fraudulent charges or suspect your information has been stolen, National Public Data advises reporting the identity theft to the Federal Trade Commission at identitytheft.gov.

How can I protect my Social Security number from being used? ›

What should I do to protect my information? Security experts recommend that consumers put freezes on their credit files at the three big credit bureaus, Experian, Equifax and TransUnion. Freezing your credit is free, and will stop bad actors from taking out loans or opening credit cards in your name.

How do I see all accounts associated with my Social Security number? ›

The simplest way to find out whether someone opened an account in your name is to check your credit reports. They will list all accounts associated with your name and Social Security number.

What to do if your Social Security number is phished? ›

What to Do if You Were Scammed
  1. Do not blame yourself. ...
  2. Stop contact with the scammer. ...
  3. Notify the three major credit bureaus: Equifax, Experian, and TransUnion to add a fraud alert to your credit report.
  4. Protect your Social Security Number.
  5. Request a replacement SSN card or new SSN, if necessary.
Dec 5, 2019

What to do if your identity has been breached? ›

Steps for Victims of Identity Theft or Fraud
  1. Place a fraud alert on your credit report.
  2. Close out accounts that have been tampered with or opened fraudulently.
  3. Report the identity theft to the Federal Trade Commission.
  4. File a report with your local police department.

What to do if you get a call saying your SSN was compromised? ›

It is a scam! Phone scammers may send official-looking letters or reports by U.S. mail, email, text, or social media message to convince you they are legitimate. The letters may appear to be from SSA or SSA OIG, with official letterhead and government jargon. They may also contain misspellings and typos.

Top Articles
Latest Posts
Recommended Articles
Article information

Author: Trent Wehner

Last Updated:

Views: 5551

Rating: 4.6 / 5 (76 voted)

Reviews: 83% of readers found this page helpful

Author information

Name: Trent Wehner

Birthday: 1993-03-14

Address: 872 Kevin Squares, New Codyville, AK 01785-0416

Phone: +18698800304764

Job: Senior Farming Developer

Hobby: Paintball, Calligraphy, Hunting, Flying disc, Lapidary, Rafting, Inline skating

Introduction: My name is Trent Wehner, I am a talented, brainy, zealous, light, funny, gleaming, attractive person who loves writing and wants to share my knowledge and understanding with you.