How did this company leak 2.9 billion people’s info, including SSNs, when the population of the US is only ~350M?
Is “National Public Data” collecting info on everyone internationally? So many questions…
Read the article? Your questions are answered there.
When applying to a US government position with a certain security clearance, they will do background checks of you, your family and extended family, if need be.
And I’m sure that can be the case for any employer who needs background checks. That being said, I also suspect some of these people in the database are dead.
I just assume ssn is for a us audience and its worlwide with equivalent numbers but who knows. I mean there are only 8 bil on the planet so thats like everyone except maybe china, india, and africa
the U.S. and other countries “around the world”
meaning, for those of us living on other planets, we are completely safe … such a relief ! /s
It’s best to say around the world just so who ever is reading it doesn’t think it region specific.
For example, they could say “the U.S. and other countries in the western hemisphere.”
How do you like : “worldwide (including self centered U.S.A.)” 🤣 ?
The other way works better since National Public Data is based in Florida and because of the name of the company. If it said “International” instead of “National” the readers would assume it is international data.
Based on the location, name of the company, and the breach mentioning social security numbers, stating the US first is the most logical.
This is why I don’t go to the National House of Pancakes.
A complaint submitted to the US District Court for the Southern District of Florida claims the exposed personal data belongs to a public records data provider named National Public Data, which specializes in background checks and fraud prevention.
What’s with these companies nobody has heard of causing massive fuck ups?
It’s capitalism. Do you hate America or something?
Because companies you’ve never heard of are the ones doing the infrastructure and data warehousing for the public-facing companies you have heard of.
Seems like a good way to have an infosec weak spot…oh…
Good god. Thats like, every person that has ever used a computer probably. Fuck.
Is there a simple way to find out if your Information was in this leak, and what information it is? I use haveibeenpwned for leaks linked to my email address, but from I read in this article, it’s not linked to my email address.
So how do I found out if my data was leaked without paying for a credit monitoring service?
We got notified by email from the credit monitoring our credit card provides.
Any company accumulating, aggregating, and centralizing every piece of private and public under the sun about people is a ticking time bomb (and that is a lot of companies these days).
We need harsher penalties for these assholes, and a privacy amendment so that we actually have some rights when dealing with them.
Also, from a national security perspective we need to make sure this isn’t a slow attack to make westerners more vulnerable than other places that aren’t liberal democracies.
I like how my social security card explicitly says not to be for identification and tax purposes only. But I need for absolutely fucking everything and to identify I’m a citizen. Can hardly sign up for a new email without a SSN. (Exaggerating of course about the email)
to identify I’m a citizen.
It’s kinda worse than that — it’s used to authenticate yourself as a citizen.
My SSN should at most be an ID, no different from a name. I can identify myself as Darth Vader or 4200-69-1337, but that shouldn’t matter, because I should never be able to authenticate myself as either of those.
I think you miss typed a number, that one doesnt seem to be working
“Please enter your full name, address and SSN to check if you were exposed!”
I tried freezing my credit but I think transunion and equifax wouldn’t let me create an account for some reason. Asking me to call them. Anybody else running into the same issue?
Happened to me, too. Just tried again a couple days later and it worked. Dunno why.
Were you on vpn by any chance?
Nope.
Are you proxying or using a VPN to access their site. I often see IP blocks, even if that proxy is a simple socks proxy to a VPS i own. Many VPS subnets are blocked/restricted wholesale, as are many of the big VPN endpoint ips.
Yeah I use VPN. Maybe I should jump to random countries or maybe turn it off.
That will 100% cause it with the 3 larger creditors (where fraud targeting is likely one of the highest…)
I did previously and had to wait until a weekday to talk to someone. It was a huge pain. Fuck those agencies.
Fuck those companies, they’d prefer that you thought of them as agencies because it makes them appear to be at least affiliated with the government.
They’re not, they are private companies through and through
I know Ticketmaster just sent out millions of “sorry we got hacked, freeze your credit for free with this code” letters. Maybe they’re struggling to keep up with demand.
Mine was for credit monitoring. You should be able to freeze your credit for free at any time
It sounds like a bad breach, and I’m not arguing against that. I just want to point out my doubts that there were ever 2.9 billion Americans since the founding of the nation, let alone since social security numbers became a thing. Maybe if I bothered to read the article, it would make more sense.
There’s something like 330 million Americans currently alive, give or take. Social Security began in 1935, so that’s 89 years ago. For the sake of making the math easy for a dumb Lemmy comment, let’s figure the population at the time was two thirds of what it is today at 220 million, and we can figure that within the margin of error virtually all of them are dead. Yes there are some Americans between the ages of 90 and 111 but they likely didn’t have social security numbers as children; the practice of assigning a SSN at birth happened later when they tied it to a tax credit for having kids; at first you got a SSN when you got your first job so anyone who was under the age of 15 or so in 1935 wouldn’t have been given one.
So let’s figure 220 million Americans who have since died, and 330 Americans who are still alive, have held social security numbers. That’s 550 million SSNs total. Rough back of the napkin math.
The SSN itself is limited to under 1 billion possible permutations anyway because the format is 9 total digits. (3 digits hyphen 2 digits hyphen 4 digits.)
And if I recall they also have something weird with the state you were born roughly corresponding to which 3 digit prefix you’re issued. Obviously that isn’t purely true either because that would only give you about 1 million unique numbers per prefix.
Either way they’ve gotta be close to the theoretical maximum of the format without recycling numbers.
Why guess at the 1935 pop instead of just looking it up?
It was about 127 million.
Because it’s a dumb Lemmy comment.
Lol, yeah “National Public Data” has records of over 3 billion people going back 30 years and these people live all over the world, so it seems.
Okay, but I’m not sure how revelant that is. The article doesn’t say only Americans were affected, it says the exact opposite.
[…] this data likely comes from both the U.S. and other countries around the world.
Like I said, I didn’t read the article, but only Americans would have social security numbers.
Social security numbers being involved in a breach does not mean that the breach only affects Americans. Some records might not have an equivalent ID number associated with them at all, and some records could have similar ID numbers from other countries. They also list current address as part of the data leaked but the fact many people don’t have a current address didn’t seem to cause you any confusion. The original source lists “information about relatives”, if that was in this title would you have assumed only people with living relatives were included?
“I didn’t read the article” is a poor excuse when you’re commenting on the believability of the article. What happened here is you saw an article, immediately assumed it was about the US, realised that doesn’t make any sense, then dismissed the article without even bothering to check because the title doesn’t fit the US exclusively. It’s crazy to me that you wouldn’t even consider the fact it’s not an exclusively US-based leak.
I mentioned the not reading the article so people would not waste their time citing facts from the article that may explain the headline that suggested billions social security numbers were leaked. I made no assumptions about missing addresses, as the headline didn’t mention anything about missing addresses. I even mentioned that the event the article discussed was probably pretty bad – definitely not a negative against the article’s believability. I’m only guilty of judging a book by its cover, and in an existence of limited time, nobody has time to do any more than that except for limited exceptions. I did not choose to make this article an exception. The headline was mathematically deceptive, and my comment was about that. Nothing more.
If you see an article highlighting a breach of social security numbers and don’t assume it’s about the U.S., that’s crazy to me.
Oh well I feel at this point every man woman and child already had this done to them in United States and our government not doing shit about it.
Stack on another “Free monitoring, 2 years”
If I get to use them consecutively, I’m good for a few lifetimes.
Just got this bullshit offer from Ticketmaster for one of their breaches and they are only offering 1 year free credit monitoring.
It’s better than the previous class action which got you nothing but a slight discount on a future Ticketmaster purchase to a very select number of concerts.
I read “free credit monitoring” as allowing your name to get on another list to be sold.
Yeah not sure I even care enough to take advantage.
Just freeze your credit. It is the simplest and easiest solution. It sucks, but it seems to be the best utensil to eat the shit sandwich we’ve been fed.
It doesn’t even suck that bad. Last time I had to unlock mine, I saw that the previous unlocking had been two years earlier. Each time I have to do it, I set an end date and it automatically relocks. Whole process takes maybe 10 minutes for the big 3 credit bureaus.
Don’t worry. Their is a service that monitors your information that you give credit monitors. You just have to give them your information.
And I’m sure they’ll delete it in two years so you’re not included in the breach 3 years from now 🙄
What if this was just a scheme to get everyone free monitoring
This one is way more than just the US.
deleted by creator
Hi Steve. Have you heard from Tom? Been a while.
deleted by creator
Otherwise, how would the republicans get enough votes.
Alrighty, brainstorming time people. If you could write some practical laws, what protections do we need to stop these from happening.
I’m thinking 3 categories: Reporting, oversight, and accountability.
Reporting: all entities holding personally identifiable information (PII) must reach out once every 12 months. This hopefully unveils seedy brokers relying on obscurity. Maybe a policy to postpone notification up to 5 years (something like that) may be available as opt-in.
Oversight: targets of PII have oversight of what is collected/used. Sensitive information may be purged permanently upon request.
Accountability: set minimum fines for types of data stored. This monetary risk can then be calculated and factored into business operations. Unnecessary data would be a liability and worth purging.
How about a government-sponsored, non-profit authentication service? That is, it should be impossible to get a loan, open a line of credit, or anything else in somebody’s name, without the lending institution verifying that it’s actually on behalf of the named individual. Eliminate the security-through-obscurity technique of using bits of easily-leaked personal information as a poor substitute for actual authentication.
I mean, (as a comparative example) I have to go through an OAuth2 consent dialog to connect a third-party app to my email account, yet somebody can saddle me with huge debts based on knowing a 9-digit number that just about everybody knows? It’s the system that’s broken, tightening up the laws on PII is just a band-aid.
This so much. In fact, go a step further and have a few competing auth services, with some regulatory oversight for managing that much pii.
The US system is broken. I have a tax file number in Australia, which is the broad equivalent of a US SSN, and you know what someone can do with it if they also have my name and DOB? Fuck-all, except file my taxes for me, because you can’t use it as an identifier anywhere else than the Australian tax office.
If I want a loan or a credit card or to open a bank account or any number of things , I need enough verifiable documents including photo ID to satisfy the other party that I am really them. Basically it’s a points system where any form of government photo ID gives you about 80 points and any other item of identifiable data gives you 10-20 points and usually you have to clear 100 points to be “identified”.
So my passport plus my driver’s licence is enough. My driver’s licence plus my non photo ID government Medicare card or my official original copy of my birth certificate is enough. My driver’s licence and two bank or credit cards is enough. About 5 or 6 things like my birth certificate, electricity bills in my name or local government rates notices and bank cards is sometimes enough, although photo ID from somewhere is usually required, or you need a statutory declaration from someone in good standing saying that you are who you say you are.
This kind of thing, while slightly more inconvenient, requires a number of physical items that can’t be easily stolen en-masse. I carry enough of them in my wallet that I can do anything I need to do, as my driver’s licence provides photo ID. People who don’t drive or have a passport can scrape together enough bits and pieces to usually get by.
So it’s time for a change. But it doesn’t have to involve technology or a huge shift in the way of doing things. It just requires a points system similar to what I describe. Whether the US can effect that change now with the millions of systems that rely on a SSN for a trivial key in a database in some small retailer somewhere, I don’t know.
That’s basically how it works in the US too. For example, for a form I-9, Employment Eligibility Verification, you need a passport, OR both proof of identity and proof of citizenship: https://www.uscis.gov/i-9-central/form-i-9-acceptable-documents
It’s similar for stuff like state drivers’ licenses.
The thing is, a federal domestic ID is all but prohibited. We have to have passports for international travel, but too many people are against federal ID because of “muh privacy”, even though it means we just end up misusing SSNs and companies like this one compensate by collecting multiple data points on each person.
Oversight: I would add a mandatory security audit annually, that they have to pay for, and which occurs during a given quarter at random (so you can’t “put on your best face” for a single day).
The security audit cost is partially subsidized if they agree to a second audit 6-9 months after the first (tax funded).
Accountability: I would add Prison time as a minimum penalty for the CEO and CIO, and the punitive damages must be a percentage of their profits (no flat rates), which is in addition to any compensatory damages awarded to plaintiffs. The penalty shall be used to help pay for future audits.
Ok, bit of an outlandish idea, but how about something like:
- Decree that information about a person is the property of that person, and therefore cannot be possessed without compensation. Think of it like intellectual property, but for your personal information
- Set a standard royalty - say $0.05/year - that must be paid to the owner of that information for as long as that information is held. This forms an incentive to not hold information you don’t need, and gives visibility to all the places that are now forced to contact you every year to pay you the royalty
- Places where you have an explicit contractual relationship with (utilities, banks, …) could have a clause to set the royalty at $0.00, but this can’t be extended to third parties - strong incentive not to transfer information to third parties
- Unauthorised transfer or loss of information could be considered IP theft, and result in significant civil penalties
Wow, you just reminded me of a data use policy I wrote up when I was young and sent a data broker after a security breach!
They laughed at me.
You and I think alike here.
PII data at rest (i.e. in a database) must be encrypted.
If the DB is running, it’s not at rest. Clients side encrypted data would be the way.
I think my definition is pretty standard: https://en.m.wikipedia.org/wiki/Data_at_rest
Dang, that’s quite a few people. Maybe we can stop linking our identity to a simple number in the US sometime? That would be swell.
Go ahead, steal my identity. See if you have any better luck with it.
I keep all my credit reports frozen. These days, everyone should.
Keep in mind there are 4 providers now, not 3!
Oh? Who’s the new one?
I am. Your login is locked unfortunately. Send me your username and password if you want to unlock it. It’s fairly common. You’ll get your credit score as well.
Such a helpful employee!
User: DaftPensioner Pass: GoRockettes1964!
Nope, I’m serious. https://innovis.com/
They’ve grown enough to require locking. There’s also https://www.chexsystems.com/ which many banks use for opening checking accounts. They’re unique because they handle stuff that doesn’t show up in a credit report.
There are actually more than 3 providers and you should put a freeze on everything you can. You only need unfrozen credit for applying for new lines of credit (loans, credit cards, etc), and unfreezing is a quick process (15 minutes or so).
Here’s a pretty comprehensive guide for protecting yourself: https://old.reddit.com/r/IdentityTheft/comments/uvv3ij/psa_freezing_your_three_main_credit_reports_is/
It’s better to take these steps before you get your identity stolen rather than after. These steps can prevent your leaked information from being used against you.
Seems like this post is two years old at this point. Is it still valid?
Even if some of the information is outdated, although I believe it’s all still valid, the main points / TL;DR are absolutely relevant. It’s unlikely that the main bureaus will change, and although the exact steps for freezing may change over time, the emphasis on freezing is important.
makes sense, thanks
