National Public Data Notified 1.3 Million After a Claim of 2.9 Billion Records

In its notification, National Public Data reported the breach as affecting approximately 1.3 million people. The seller’s figure was 2.9 billion records. The independent analysis at 24-0812 found 134 million unique email addresses.

That is the mistake to avoid. The seller counted rows. The researcher counted distinct email addresses, which is a proxy for people that under-counts everyone without an email in the set. The company counted people it determined it was legally obliged to notify.

Three different questions, three different answers, and only the last one has a definition anybody can check — because a notification threshold is written down.

A notification covering 1.3 million people, against a set containing 134 million email addresses, invites an obvious question: what happened to the other 132.7 million?

The plausible answer is jurisdictional. Notification obligations attach to residents of particular states and countries, and to particular data types. A person whose record was in the file but whose combination of residence and exposed fields did not trigger a duty is simply not counted.

This desk records that as the likely explanation and not as an established one. No breakdown has been published.

It is the strongest available demonstration that a notification figure is a legal artefact rather than a measurement of exposure. The corpus has said so repeatedly — at 24-0620, at 25-0717 — and has generally had a factor of two or three to point at.

Here the factor is a hundred. A reader treating notification counts as a measure of how many people were exposed would be wrong by two orders of magnitude in this case, and there is no way to know from the outside which cases are like this one.