Background Check Company Allegedly Failed to Protect Sensitive Data
A class action lawsuit has been filed against Jerico Pictures Inc. operating as National Public Data (NPD), a background check company, alleging that billions of records containing personal information of U.S. residents may have been exposed in the National Public Data Breach.
The complaint, filed in Florida, argues that NPD “scrapes the [personal information] of potentially billions of individuals from non-public sources” without the consent of those individuals. Among those allegedly impacted is Christopher Hofmann, the named plaintiff in the case.
According to the lawsuit, Hofmann received a notification from his identity theft protection service provider on July 24th alerting him that his data was exposed in a breach and leaked on the dark web. The suit claims Hofmann never gave NPD access to his personal information.
Website Reported Massive Database Leak and Sale
The lawsuit points to findings reported by VX-Underground, an educational website about malware and cybersecurity. In early April 2024, the website reported that a Threat Actor known as “USDoD” had placed a large database up for sale on Breached titled “National Public Data”, claiming it contained 2.9 billion records on United States citizens and was putting it up for sale for $3.5 million.
VX-Underground informed that USDoD planned to leak the database if not sold. They received an advanced 277.1GB copy of the massive file and determined it was real. It contained names, addresses dating back decades, social security numbers, and information to identify relatives of those who did not opt-out of data collection.
Allegations of Failure to Secure Sensitive Data
The lawsuit accuses NPD of failing to properly secure and safeguard the personally identifiable information collected as part of regular business practices. NPD told customers submitting background checks that their information would be kept safe, confidential and private only as long as needed.
However, attorneys allege NPD failed to do so. The lawsuit also acknowledges NPD has not officially notified those impacted about the data breach details, including when and how it occurred. This could be one of the largest data breaches in history if billions of individuals were truly impacted.
As of now, there are no upcoming court dates scheduled in the case. This ransomware attack and alleged failure by NPD to protect sensitive personal information of potentially billions could have severe consequences. Individuals are encouraged to closely monitor accounts for signs of identity theft.
