In April 2024 an actor using the handle USDoD listed roughly 2.9 billion records for sale on a criminal forum, said to come from National Public Data, a background-check and fraud-prevention service. In August a large portion was published freely and the coverage began.
The claimed contents were names, current and former addresses, Social Security numbers, dates of birth and telephone numbers, covering people in the US, UK and Canada.
The Number Was Reported As People
A great deal of coverage described 2.9 billion individuals, and some described 2.9 billion Americans. The population of the United States is around 333 million.
That is not a small error. It is a figure roughly nine times the population of the country it was attributed to, reported without the arithmetic being done.
Why This Desk Grades It Low
The corpus standard is that a grade tracks what is established, not how large the incident sounds. Here the volume came from a seller on a forum, the company had said nothing, and no independent examination had been published at the point the figure entered general circulation.
What followed — filed at 24-0812 and 24-1001 — is the most complete correction of an attacker claim anywhere in this database.
The Affected Population Never Chose This Company
A background-check broker assembles records about people who are not its customers, from sources they did not know were being collected, for buyers they will never meet. Nobody in the file agreed to be in the file.
The corpus files that under concentration: the breach happens somewhere the affected person has never heard of. This is the version where there was never a relationship to have heard of.
Compiled from contemporaneous reporting, listed below. The 2.9 billion figure originates with the party offering the data for sale and is labelled a claim throughout; this desk has not seen the listing or reviewed any sample. Graded low because almost nothing was established at this point in the story, not because the incident was small. See 24-0812 and 24-1001 for what was established later. Corrections: corrections@forensicpost.com.