Hackers may have stolen the Social Security numbers of many Americans. Here’s what to know.

A brand new lawsuit is claiming hackers have gained entry to the private info of “billions of people,” together with their Social Safety numbers, present and previous addresses and the names of siblings and oldsters — private knowledge that might permit fraudsters to infiltrate monetary accounts or take out loans of their names. 

The allegation arose in a lawsuit filed earlier this month by Christopher Hofmann, a California resident who claims his identification theft safety service alerted him that his private info had been leaked to the darkish net by the “nationalpublicdata.com” breach. The lawsuit was earlier reported by Bloomberg Regulation.

The breach allegedly occurred round April 2024, with a hacker group referred to as USDoD exfiltrating the unencrypted private info of billions of people from an organization referred to as Nationwide Public Information (NPD), a background test firm, in response to the lawsuit. Earlier this month, a hacker leaked a model of the stolen NPD knowledge without cost on a hacking discussion board, tech web site Bleeping Pc reported. 

That hacker claimed the stolen information embody 2.7 billion data, with every itemizing an individual’s full identify, handle, date of start, Social Safety quantity and telephone quantity, Bleeping Pc mentioned. Whereas it is unclear how many individuals that features, it is possible “that everybody with a Social Safety quantity was impacted,” mentioned Cliff Steinhauer, director of data safety and engagement at The Nationwide Cybersecurity Alliance, a nonprofit that promotes on-line security.

“It is a reminder of the significance of defending your self, as a result of clearly corporations and the federal government aren’t doing it for us,” Steinhauer informed CBS MoneyWatch.

NPD did not instantly reply to a request for remark. 

This is what to know concerning the alleged hack. 

What’s Nationwide Public Information? 

Nationwide Public Information is an information firm primarily based in Coral Springs, Florida, that gives background checks for employers, investigators and different companies that need to test individuals’s backgrounds. Its searches embody legal data, important data, SSN traces and extra info, its web site says.

There are numerous related corporations that scrape public knowledge to create information on customers, which they then promote to different companies, Steinhauer mentioned.

“They’re knowledge brokers that gather and promote knowledge about individuals, typically for background test functions,” he mentioned. “It is as a result of there is no nationwide privateness regulation within the U.S. — there isn’t a regulation in opposition to them gathering this knowledge in opposition to our consent.”

What occurred with the USDoD hack?

Based on the brand new lawsuit, USDoD on April 8 posted a database referred to as “Nationwide Public Information” on the darkish net, claiming to have data for about 2.9 billion people. It was asking for a purchase order value of $3.5 million, the lawsuit claims. 

Nevertheless, Bleeping Pc reported that the file was later leaked without cost on a hacker discussion board, as famous above. 

How many individuals have been impacted?

The variety of individuals impacted by the breach is unclear. Though the lawsuit claims “billions of people” had their knowledge stolen, the entire inhabitants of the U.S. stands at about 330 million. The lawsuit additionally alleges that the info consists of private info of deceased people.

Bleeping Pc reviews that the hacked knowledge includes 2.7 billion data, with people having a number of data within the database. In different phrases, one particular person might have separate data for every handle the place they’ve lived, which suggests the variety of impacted individuals could also be far decrease than the lawsuit claims, the location famous.

The information might attain again a minimum of three a long time, in response to regulation agency Schubert Jonckheer & Kolbe, which mentioned on Monday it’s investigating the breach.

Did NPD alert people concerning the hack? 

It is unclear, though the lawsuit claims that NPD “has nonetheless not supplied any discover or warning” to Hoffman or different individuals affected by the breach. 

“In actual fact, upon info and perception, the overwhelming majority of Class Members have been unaware that their delicate [personal information] had been compromised, and that they have been, and proceed to be, at important threat of identification theft and numerous different types of private, social, and monetary hurt,” the lawsuit claims. 

Data safety firm McAfee reported that it hasn’t discovered any filings with state attorneys common. Some states require corporations which have skilled knowledge breaches to file reviews with their AG workplaces. 

What ought to I do to guard my info?

Safety consultants advocate that buyers put freezes on their credit score information on the three huge credit score bureaus, Experian, Equifax and TransUnion. Freezing your credit score is free, and can cease dangerous actors from taking out loans or opening bank cards in your identify. 

“The most important factor is to freeze your credit score report, so it could possibly’t be used to open new accounts in your identify and commit different fraud in your identify,” Steinhauer mentioned. 

Steinhauer recommends customers take a number of further steps to guard their knowledge and funds:

• Ensure that your passwords are a minimum of 16 characters in size, and are complicated. 
• Use a password supervisor to save lots of these lengthy, complicated passwords.
• Allow multifactor authentication, which Steinhauer calls “essential,” as a result of merely utilizing a single password to entry your accounts is not sufficient safety in opposition to hackers. 
• Be on alert for phishing and different scams. One pink flag is that the scammers will attempt to create a way of urgency to govern their victims.
• Maintain your safety software program up to date in your pc and different gadgets. For example, be sure to obtain the newest safety updates from Microsoft or Apple onto your apps and gadgets. 

You can even get a monitoring service that can provide you with a warning in case your knowledge seems on the darkish net. 

“You must assume you might have been compromised and act accordingly,” Steinhauer mentioned.