Desk live·
ForensicPost
Breaches/Verification/File 24-0806

Two Point Nine Billion Records, From a Company Nobody Had Heard Of

A background-check broker was said to have lost records on most of the United States, United Kingdom and Canada. The figure came from the person selling it.

Constructed geometry · not a chart of case data
TargetNational Public Data
ActorUSDoD
D. Kennedy12 min readConfidence: low3 sources reviewed

In April 2024 an actor using the handle USDoD listed roughly 2.9 billion records for sale on a criminal forum, said to come from National Public Data, a background-check and fraud-prevention service. In August a large portion was published freely and the coverage began.

The claimed contents were names, current and former addresses, Social Security numbers, dates of birth and telephone numbers, covering people in the US, UK and Canada.

The Number Was Reported As People

A great deal of coverage described 2.9 billion individuals, and some described 2.9 billion Americans. The population of the United States is around 333 million.

That is not a small error. It is a figure roughly nine times the population of the country it was attributed to, reported without the arithmetic being done.

Why This Desk Grades It Low

The corpus standard is that a grade tracks what is established, not how large the incident sounds. Here the volume came from a seller on a forum, the company had said nothing, and no independent examination had been published at the point the figure entered general circulation.

What followed — filed at 24-0812 and 24-1001 — is the most complete correction of an attacker claim anywhere in this database.

The Affected Population Never Chose This Company

A background-check broker assembles records about people who are not its customers, from sources they did not know were being collected, for buyers they will never meet. Nobody in the file agreed to be in the file.

The corpus files that under concentration: the breach happens somewhere the affected person has never heard of. This is the version where there was never a relationship to have heard of.

How we reported this

Compiled from contemporaneous reporting, listed below. The 2.9 billion figure originates with the party offering the data for sale and is labelled a claim throughout; this desk has not seen the listing or reviewed any sample. Graded low because almost nothing was established at this point in the story, not because the incident was small. See 24-0812 and 24-1001 for what was established later. Corrections: corrections@forensicpost.com.

Sources
  1. Unconfirmed hack of 2.9 billion records at National Public Data sparks media frenzySecurityWeek
  2. Background check company breach puts 2.9 billion records at riskASIS International
  3. National Public Data breach: what happened, impact, and lessonsHuntress
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary