National Public Data: The Data Broker You Never Met

Somewhere in a town you have never visited, there is a clerk with a folder on you.

You have never met this clerk. You have never sent them a form, signed a consent box or bought anything from them. They know your full name, and the two other orders people sometimes write it in. They know every flat you have rented since 1996, including the one with the possum in the roof. They know your date of birth, your phone number from three phones ago, your mother's maiden name (by way of your mother), and the name of an uncle you met twice at weddings. They have also kept your grandfather's folder, which is thoughtful of them, because he died in 2005 and nobody else has asked about him in years.

The clerk is not a spy. The clerk is a business. For a small fee, they will photocopy your folder for anyone with an account: a landlord, an employer, a debt collector, a website that sells "background checks", or another clerk in another town who wants to make their folders fatter. They have no monthly minimums and no setup fees. They say so on their website.

Then, one evening, the clerk leaves the back door open. By the morning, the folders are on a forum, and a man who calls himself after a US government department is selling all of them for three and a half million dollars.

That is, give or take the possum, what happened to National Public Data this year.

Put the biscuit down for a second. You did not miss a disaster in your own inbox, and if you live in Australia, your folder is very probably not in this particular pile. But this is the most useful privacy story of 2024 so far, because it shows something that is usually invisible: the industry that keeps the folders, how it fills them, and why the folders are so dangerous when they get out. That industry operates in Australia too.

Here are the stakes in one number. When independent researchers counted the leaked files, they found 272 million unique US Social Security numbers, with names and home addresses attached, now circulating for free. Most of the people behind those numbers had never heard of the company that lost them.

So here is the plan. First, what happened, and why the "2.9 billion people" headline is wrong (in a way that matters). Then, what a data broker actually is, and how a computer builds a folder on someone it has never met, down to the maths the US Census Bureau uses. Then, why a Social Security number is the worst possible thing to lose, why Australia has its own version of it, and what our law does and does not say about the clerks. Finally, a short list for this week.

Let's get into it.

Part 1: What Happened, and What the Numbers Mean

National Public Data (NPD) is, in its own words, "a public records data provider specializing in background checks and fraud prevention". Its home page in April said its customers were "investigators, background check websites, data resellers, mobile apps, applications and more", and that it obtains information "from various public and non-public record databases, court records, state and national databases and other repositories nationwide". You did not buy anything from NPD. The websites that sold background checks did, by the query, through an API.

Brian Krebs traced the company to an entity in Coral Springs, Florida, called Jerico Pictures Inc., a film studio owned by Salvatore Verini Jr., a retired deputy with the Broward County Sheriff's office. A background-check company run from a film studio by a retired sheriff's deputy sounds like the pitch for a cable drama. It is also a fair picture of how low the barrier to entry is.

The timeline

The order of events matters, because the story arrived in the press months after it started.

• Late December 2023. NPD's own notice says the incident "is believed to have involved a third-party bad actor that was trying to hack into data in late December 2023".
• 8 April 2024. A seller called USDoD posted a database titled "National Public Data" on a crime forum, claiming 2.9 billion records, for $3.5 million. The listing said it covered "the entire population of USA, CA and UK".
• 1 June. The malware research group vx-underground said it had reviewed a copy and confirmed it was real (more on that below).
• 23 July. "Partial" dumps started to appear for free on forums.¹
• 24 July. A Californian man, Christopher Hofmann, got an alert from his identity-theft protection service that his details were on the dark web. On 1 August he filed a class action against Jerico Pictures in a federal court in Florida.
• 6 August. A different hacker, "Fenice", leaked "2.9b records" of names, addresses and plain-text Social Security numbers for free. Troy Hunt found it matched the files he had been sent in June.
• By 13 August. NPD had posted a notice on its website. It said the leaked data "contained name, email address, phone number, social security number, and mailing address(es)", and it advised people to check their credit reports and consider a credit freeze.

Two small details on that notice are worth a moment. First, BleepingComputer found that NPD's statement was blocked for visitors from many US locations and from outside the country, which is a bold choice for a page whose only job is to be read. Second, the same page template that carried the breach notice also carried the company's usual sales pitch underneath: "SSN Traces, SSN Validation, Criminal Records, Profile Reports and more are all available via our XML API gateway." I do not think anyone wrote that for effect. It is just the footer. It is still the most honest summary of the business I have read.

Then, on 19 August, Krebs reported that a sister site, recordscheck.net, had been hosting an archive called "members.zip" that contained the site's source code and the administrator's username and password in plain text. Users had all been given the same six-character password and told to change it. Many did not. The founder told Krebs it was "an old version of the site with non-working code and passwords". Please change your passwords, everyone. Especially if you sell other people's Social Security numbers for a living.

Rows are not people

The headline number was 2.9 billion. Many outlets turned that into "2.9 billion people", and the class action itself repeats the seller's claim of "approximately 2.9 billion individuals". That is more than a third of everyone alive and about nine times the population of the United States. Troy Hunt, who runs the breach notification service Have I Been Pwned (HIBP), pointed out the first problem straight away: the seller's own listing claimed the USA, Canada and the UK, which is about 450 million people in total. So what was the 2.9 billion?

Rows. Hunt received the two Social Security number (SSN) files in June. They had 1,698,302,004 and 997,379,506 rows: about 2.7 billion between them. In the first rows he showed, six rows shared one SSN and were all the same person, with the name in different orders and different addresses in the same city. He took 100 million rows and found that only 31% had a unique SSN. In his words: "'2.9B' doesn't necessarily mean 2.9B people, it often means rows of data." His extrapolation from the sample was about 899 million.

Two days later, Krebs reported a count across the whole set by Atlas Data Privacy Corp.: 272 million unique SSNs. That is the number I would use. A sample can mislead when duplicates cluster, and a full count is better than an extrapolation. But the direction is the same in both: each person appears many times, once for each address, spelling and source the broker ever stitched together. And some of those people are no longer alive.

max_tokensPOST./v1/messages

Atlas also found that the records belong to people born before 1 January 2002, with very few exceptions, that the average age is 70, and that two million records belong to people who would now be more than 120 years old. That fits what vx-underground saw in June: the file had people "deceased for nearly 2 decades". A broker that never deletes anyone is, in a grim way, the most complete family history service on Earth.

Opted out, and therefore absent

The single most revealing sentence in this whole story came from vx-underground on 1 June, before most of the world had heard of NPD:

1. The database DOES NOT contain information from individuals who use data opt-out services. Every person who used some sort of data opt-out service was not present.

— vx-underground (@vxunderground), 1 June 2024 on X

Read that twice. The people who were safe were the people who had found the clerk and asked to be taken out of the folder. Everyone else was in it, with "Address history (3 decades+)", their SSN, their parents, siblings, aunts, uncles and cousins. The leak was a copy of the product. That points to a legitimate aggregator as the source, because a criminal collection would have no reason to leave out the people who had opted out.

And the email addresses?

Here is the part that confused a lot of people who got an alert. Later dumps in late July and early August were much bigger and messier. One of them was 642GB across more than a thousand files, and it held 134 million unique email addresses, which Hunt loaded into HIBP. He labelled it as unverified, because he could not prove where all of it came from. One of his own addresses was on 28 rows, next to a name, address and numbers that were not his, and two dates of birth that would make him born in 1936 or 1967. ("Both are a long way from the truth.")

He was blunt about what that means for you: "there were no email addresses in the social security number files. If you find yourself in this data breach via HIBP, there's no evidence your SSN was leaked, and if you're in the same boat as me, the data next to your record may not even be correct."²

So, an email alert from HIBP about NPD tells you your address was in a pile that may or may not have come from NPD. It does not tell you your SSN is out. An alert from a credit monitoring service that searches by SSN is a different, more serious thing. Read which one you got.

Part 2: What a Data Broker Actually Is

stop_reasoneval:.pass

Every town has an unofficial broker already. In a small town, it is the person at the post office, or the woman who has run the bakery for thirty years. She knows who moved into the blue house, whose son is back from Melbourne, and that the Hendersons' ute has been outside the pub every Thursday since March. No one gave her this information. She assembled it from what passed her counter, and she shares it, for a small social fee, with anyone who buys a vanilla slice.³

Now take away the vanilla slice, add a database, and make the counter the size of a country. That is a data broker.

The definition, and the important bit

The best plain description I know is still the US Federal Trade Commission's 2014 study of nine brokers. Data brokers are "companies that collect consumers' personal information and resell or share that information with others", and the key phrase comes next: "Because these companies generally never interact with consumers, consumers are often unaware of their existence".

That is the whole problem in one sentence. In most of your data relationships, there is a door you walked through. You signed up for the loyalty card, you clicked the banner, you gave the airline your passport number. With a broker, there is no door. You are the product and you have never been to the shop.

Australia's competition regulator said the same thing this May. In its report on data firms, ACCC Deputy Chair Catriona Lowe said: "In many cases, the data firms do not have a direct relationship with the consumers whose data may be used." The ACCC also noted that many of these firms do not call themselves "data brokers" at all. They prefer "data analytics business", "data enrichment firm" or "data collaboration platform". (A rose, by any other name, still has your old address.)

Three things they sell

The FTC sorted broker products into three kinds, and NPD fits neatly into two of them.

• Marketing products. Lists and segments: who has a boat licence, who likes motorcycles, who is an "Expectant Parent". One broker in the study had 3000 data segments for nearly every US consumer.⁴
• Risk mitigation products. Identity verification and fraud checks. The FTC's example is a lender who checks whether an SSN on an application "has recently been associated with many different addresses". This is where NPD's "SSN Trace" lives.
• People search products. Websites where anyone can look up a name and get an address, phone number, relatives and court records. NPD sold its data by API to "background check websites", which is this category with one more layer in between.

The ACCC's list for Australia is similar: data-driven marketing and advertising, risk management "such as identity verification and fraud detection services", and property data.

Brokers buy from brokers

The finding that surprises most people is this one. The nine brokers in the FTC study "obtain most of their data from other data brokers rather than directly from an original source", and seven of the nine provided data to each other. The FTC concluded that "it would be virtually impossible for a consumer to determine how a data broker obtained his or her data; the consumer would have to retrace the path of data through a series of data brokers."

NPD is a small example of the same thing. Krebs found that recordscheck.net pulled its reports by querying NPD's database and records at another provider. And if you ask where NPD got its SSNs, the honest answer as of today is that no one outside the company knows. Its own website said "public and non-public record databases". The class action alleges, "upon information and belief", that it "scrapes the PII of potentially billions of individuals from non-public sources". That is an allegation, not a finding. Krebs notes that the website does not name its sources, and adds: "It remains unclear how thieves originally obtained these records from National Public Data."

We will come back to one likely route in Part 4. First, the more interesting question: how does a pile of scraps become one folder per person?

Part 3: How a Machine Builds a Folder on Someone It Has Never Met

Step one: you already do this

You get a voicemail: "Hi, it's Sam, from the thing on Saturday, call me back." You know three Sams. One is your dentist. One is your cousin. One is a man you met at a barbecue on Saturday. You decide in about a second that it is the third one. You did not check an ID number. You compared clues: the voice, "the thing on Saturday", and the fact that your dentist has never once called you on a weekend. Some clues counted for more than others. If it had been a less common name, say Ignatius, you would have needed fewer clues.

That is record linkage. You do it every day.

Step two: name it

Record linkage, also called entity resolution or, in the trade, "merge/purge", is deciding whether two records describe the same real-world person when there is no shared ID number to tell you. A US Census Bureau overview by William Winkler puts it simply: it is used to "identify duplicates when unique identifiers are unavailable", and it "relies primarily on matching of names, addresses, and other fields that are typically not unique identifiers".

This matters to a broker because each source only knows a few things. In the FTC's words, "each data broker source may provide only a few data elements about a consumer's activities", but brokers "can put all of these data elements together to form a more detailed composite of the consumer's life". The value is not in any one record. It is in the join.

Step three: a worked example

Let me make it concrete with a made-up person. Meet Beverly Tolliver. She lives in Ohio, and she is entirely invented, so please do not look her up. Over fifty years, different systems each wrote a little about her:

• 1969. The Social Security Administration issues her a number when she gets her first job at a diner. It records her name, her date of birth and the number. Nothing else knows the number yet.
• 1988. She registers to vote. The county roll records "TOLLIVER, BEVERLY A", her address on Maple Street and her birth year.
• 1996. She subscribes to a gardening magazine as "Bev Tolliver". The publisher records the name and the Maple Street address, and later rents that list to marketers.
• 2004. She and her husband buy a house on Ridge Road. The property record shows "Beverly A. Tolliver" and "Gary Tolliver".
• 2011. She gets a speeding ticket. The court record has her full name, date of birth and the Ridge Road address.
• 2019. She co-signs a lease for her son. The application, which ends up with a credit bureau, has her name, date of birth, SSN and the Ridge Road address.

None of these records is a folder. Each one is a scrap. Now a broker buys or collects all six. How does a machine, which has never met Beverly, decide they are one person?

page_viewtool_use

Step four: the real mechanism

The standard method goes back to Howard Newcombe in 1959, and was given its formal maths by Ivan Fellegi and Alan Sunter in 1969. It works in four moves.

1. Blocking. You cannot compare every record with every other record. With hundreds of millions of rows, that is more pairs than there are grains of sand on Bruny Island.⁵ So you only compare records that share a cheap key, such as the same surname and birth year. Winkler describes this as only "considering pairs that agreed on a characteristic such as surname or date-of-birth". Beverly's voter roll and her speeding ticket land in the same block. A Beverly Tolliver in Oregon born twenty years later does not.

2. Comparing fields. For each pair, the system checks each field: does the first name agree, the address, the date of birth? This gives an agreement pattern, for example "name yes, address yes, birth date not available".

3. Weighting. Here is the clever part. Fellegi and Sunter asked: how much more likely is this agreement pattern if the two records are the same person than if they are different people? That ratio is the match weight. Agreement on a rare value counts for more than agreement on a common one. Winkler's examples are "Smith" and "Zabrinsky": two records that agree on Zabrinsky are much more likely to be the same person than two that agree on Smith. Tolliver is closer to Zabrinsky. That is why Beverly is easy, and why the same process struggles with a John Smith in a big city. (Remember the voicemail. Ignatius needs fewer clues.)

4. Two thresholds. The system sets an upper and a lower cut-off. Above the upper one, the pair is a match and the records merge. Below the lower one, it is not a match. In between is what Winkler calls the "clerical review region", where in a careful system a person looks at it. In a cheap system, nobody does.

Run that over Beverly's six scraps, and the voter roll, the magazine list, the property record, the court record and the lease all merge, through shared addresses and dates of birth, into one profile. The property record adds Gary. The lease adds the son. Now Beverly's folder has an address history, two relatives and an SSN, and it can be sold by the query.

Notice what the SSN does in that last step. It is the one field that is unique to a person. When two records both carry it, there is no need to guess: no weights, no thresholds, no clerk. A broker that has the SSN can use it as the spine for everything else, and every new scrap that carries it clicks straight into place. That makes it the most valuable field in the file to hold, and the most dangerous one to lose.

utm_source=SELECT

What goes wrong

This is also why the NPD data is both too accurate and wrong. Linkage makes mistakes in both directions. A false non-match leaves one person split over many rows (six rows for one SSN, in the rows Hunt showed). A false match glues two people together, which is one way an email address like Hunt's can end up beside a stranger's name and two birthdays that were not his. And because the broker rarely deletes anything, old addresses and dead relatives stay in the folder for good. BleepingComputer checked a few records and found the data did not include the current address of any of them.

None of that makes the leak harmless. An identity thief does not need your current address. They need your name, date of birth and SSN. Which brings us to the number itself.

Part 4: The Number That Was Never Meant to Be a Password

aria-labelgtm.js

There are two different jobs a piece of information can do. An identifier says who you claim to be: your name, your username, your customer number. An authenticator proves it: your password, your fingerprint, the code on your phone. You can show an identifier to anyone. You must keep an authenticator secret. The trouble starts when one thing is asked to do both jobs.

The US Social Security number was created as an identifier. The Social Security Administration began issuing it in 1936 "for the purpose of tracking workers' earnings over the course of their lifetimes to pay benefits". Over the following decades, banks, lenders, phone companies and employers started to ask for it as proof that you are you. As two researchers put it in 2009, SSNs were created as identifiers for earnings accounts, and "have turned into sensitive authentication devices".

You could predict it anyway

That 2009 paper, by Alessandro Acquisti and Ralph Gross, is worth a detour, because it shows how weak the secret already was. Before 2011, an SSN's first three digits were tied to the state where it was issued, and numbers were handed out in a pattern. Using only public data, mainly the Social Security Administration's own Death Master File of dead people's numbers, the researchers could guess the first five digits in one attempt for 44% of the dead people in that file who were born between 1989 and 2003. For 8.5% of them, they could get the whole number in fewer than 1,000 attempts, "making SSNs akin to 3-digit financial PINs".

The Social Security Administration changed to random assignment on 25 June 2011, which removed the meaning of the state digits for new numbers. That helps people born after 2011. Atlas found that the NPD records almost all belong to people born before 2002. So the NPD file is almost entirely the pre-randomisation population, the people whose numbers followed the old pattern, now with no guesswork needed at all.

Why a leaked SSN does so much harm

A leaked password is bad for a week. You change it. A leaked SSN is bad for life, because you cannot easily change it, and other systems still treat it as proof. Krebs put it plainly this month: the NPD breach is another chance for US leaders to "acknowledge that the SSN has completely failed as a measure of authentication or authorization".

And here is the likely route by which the SSN reaches brokers in the first place, at least for the industry in general. In August 2023, the head of the US Consumer Financial Protection Bureau, Rohit Chopra, said that "much of the current data broker market runs on personally identifying information taken from traditional credit reports", which "includes key identifiers like name, date of birth, and Social Security number". This is called credit header data: the identity block at the top of a credit file. The CFPB said it intends to propose rules under the Fair Credit Reporting Act to deal with it, partly because the same data can be used to find people "who don't wish to be contacted, such as domestic violence survivors". As of August 2024, those rules have been announced as a plan, not made. To be clear, nobody has shown that NPD got its SSNs this way. It is how the market usually gets them.

What about Australia?

We do not have an SSN. We have something that does the same two jobs badly: the driver licence number. It is an identifier printed on a card you hand to anyone who asks, and it is also used in identity checks as proof of who you are. When Latitude Financial was breached in March 2023, the attackers took about 7.9 million Australian and New Zealand driver licence numbers, plus 6.1 million further records that dated back to 2005 and were provided before 2013. That last detail is the NPD lesson in Australian form: a company kept records that had been provided more than a decade earlier, and lost them anyway.

Part 5: Why Opting Out Is Not a Plan

If a broker never meets you, how do you get out of the folder? In the US, the answer is "with difficulty, and only partly".

NPD's own opt-out page is a small masterpiece. It explains the rights that residents of California, Virginia, Colorado, Connecticut and Utah have under their state laws, then notes that those rights do not apply to "publicly available information", among other things. "Accordingly," it says, "we may continue to collect, process, use, share, and sell these exempt types of information about you, even after granting your request". It also says that if you ask it to correct something wrong, it may "elect to delete the portion of personal information that you consider inaccurate, instead of changing it". Your data's accuracy is your problem; its existence is theirs.⁶

Krebs makes the wider point: public records "are carved out from every single state consumer privacy law", including California's, and "virtually anyone can become a consumer data broker". I wrote about California's law in 2022, in The California Consumer Privacy Act (CCPA): An Unprecedented Ride in Data Privacy. It was a real step. It still lets the broker keep the public-record spine of your folder.

California is now going further. Brokers must register with the California Privacy Protection Agency each year, for a $400 fee, and from 1 August 2026 they must check a single state deletion system at least every 45 days and process the deletion requests in it, with limited exceptions. One request, every broker. That is two years away, and it only helps Californians.

So the vx-underground finding is both good news and bad news. Opting out worked: those people were not in the file. But it only worked for people who knew the broker existed, found the form, and did it before December 2023. For a business that "generally never interacts with consumers", that is a very small group.

Part 6: Why Australians Are Not Immune

I will be precise here, because it is easy to scare people. There is no evidence that Australians are in the NPD file. The seller claimed the USA, Canada and the UK, and NPD's own menu listed a "Canadian People Finder". If you have never lived in North America or the UK, your folder is very probably not in this pile.

But the clerk is not only American. The clerk is a business model, and it works the same way here.

We have data firms too

The ACCC's eighth Digital Platform Services Inquiry report, published on 21 May this year, looked at exactly this industry. It found that consumers are generally unaware how much of their data is collected and shared with data firms, that long privacy policies with "take-it-or-leave-it" terms make it hard to consent to anything meaningfully, and that 74% of Australians are uncomfortable with their personal information being shared with or sold to other companies. It also warned about re-identification as datasets are combined, which is record linkage by another name, and about segments such as "frequent gamblers" being used to sell gambling to people with an addiction.

What our law says about trading in people

The Privacy Act 1988 does not cover most small businesses, which the OAIC defines as those with an annual turnover of $3 million or less. But there is a catch that is aimed squarely at the clerk. A small business that trades in personal information can still be covered. The OAIC's test is whether a business provides "a benefit, service or advantage to collect personal information", or discloses it "for a benefit, service or advantage". Its example: "a small business sells their customer list to a marketing company or gives their own list in return for another list." The next question in the OAIC's checklist is whether it does so without the person's consent and without being required or authorised by law. So, in Australia, a broker cannot shelter under the small business exemption just because it is small, unless it is trading with consent or under a law.

The law is also about to change, slowly. In September 2023, the Government responded to the Privacy Act Review. I wrote about it at the time in Breaking Down Australia's Privacy Law Overhaul. The response agrees in principle that the small business exemption should be removed, that in the shorter term small businesses that trade in personal information should no longer be able to rely on it, that "an individual's consent should be required in order to trade their personal information", and that individuals should get a right to erasure. It also cites a survey in which 87% of Australians said trading in personal information is not fair and reasonable. "Agreed in principle" means more consultation first. As of August 2024, none of those proposals is law.

The rule that would have helped most

The rule that would have saved the most people in the NPD case already exists in Australia, and it is short. Australian Privacy Principle 11.2 says that when an organisation no longer needs personal information for any permitted purpose, and is not required to keep it, it "must take such steps as are reasonable in the circumstances to destroy the information or to ensure that the information is de-identified".

Two million records of people aged over 120 is the opposite of that rule. So are Latitude's records from 2005. A folder that does not exist cannot be stolen.

What to Do This Week

GPC:.1await

If you are in the US and have just reached for your phone to freeze your credit, good. Do it, then come back. This article will wait. It has nowhere else to be.

If you are in the United States, or have lived there

1. Freeze your credit at all three bureaus. A freeze stops new lenders from pulling your file, so a thief with your SSN cannot easily open accounts in your name. Krebs' advice is direct: if you have not frozen your files and have not yet had new-account fraud, "the ID thieves probably just haven't gotten around to you yet". NPD's own notice points to the same three bureaus.
2. Get your free credit reports. Krebs notes Americans can get one weekly from each of the three bureaus. Look for accounts and inquiries you do not recognise, and dispute errors.
3. Read your alert carefully. An HIBP alert about NPD means your email address was in a later, unverified pile without SSNs. A monitoring alert that matched your SSN is the serious one.
4. Do not type your SSN into a stranger's "check if you were breached" site. Some lookup sites are legitimate. Some are the next scam. If a site asks for your full SSN to tell you whether your SSN leaked, close the tab.

If you are in Australia

1. Read your own credit file. Each credit reporting body must give you your report free once every 3 months. Ask Equifax, Experian and illion separately, because they can hold different information. It is the nearest thing we have to reading the clerk's folder.
2. Treat your licence number as compromised by default. Many of us have handed it to a real estate agent, a car hire desk or a pub. Do not let it be the only thing between a stranger and your accounts.
3. Protect the accounts that matter with a second factor. If someone knows your name, date of birth and licence number, the second factor is what stops them. I explained how two-factor authentication works in What is Two-Factor Authentication and Why Do We Use It?, and a password manager makes unique passwords painless.

If you run a business

1. List every place you store identity documents and numbers. Licence, passport, Medicare, tax file number. Write down why you keep each one.
2. Set a retention date for each, and delete on that date. APP 11.2 already asks for this. If you collected a licence number to verify someone once, you probably do not need it in 2030.
3. Never use a static identifier as proof of identity. A licence number, date of birth or customer number is an identifier. Pair it with something the person has, such as a one-time code.
4. Ask your data suppliers where their data came from. If you buy lists, enrichment or "identity verification", ask your supplier the FTC's question: where did this come from, and could the person retrace that path? If the answer is vague, so is your compliance.
5. Check whether you trade in personal information. If you sell, swap or share customer data for any benefit, the small business exemption may not protect you, whatever your turnover.

Final Thoughts

Go back to the clerk in the town you have never visited, pasting scraps into your folder. Nothing in this story required the clerk to be a villain. It only required a business that never meets the people it sells, a number that was never meant to be a password, a matching process that never forgets, and a back door that somebody found in December.

If you remember one thing, make it this: the dangerous part of a data broker is not any single record. It is the join. Each scrap on its own is dull: a voter roll, a magazine list, a speeding ticket. Linked by a unique number and kept forever, they become a folder that can open a bank account in your name. The defence is the same at every scale: hold less, link less, delete on time, and stop treating identifiers as keys.

So this week, freeze or read your credit file, depending on which side of the Pacific you are on. If you run a business, find the oldest identity document you are still storing for no reason, and delete it.

Now, if you'll excuse me, I am going to make a cup of tea, my fourth of the day and roughly cup number 1,200 of the year. I am telling you that freely. It is the only part of my folder I am happy to publish.

Notes

1. Sources differ on the details. Krebs dates a release of "more than 4 terabytes" on Breachforums to 21 July. Troy Hunt describes an 80GB "partial" set on 23 July and a 642GB set on Telegram in early August. Both agree the full SSN data was out for free by early August. ↩

2. Troy Hunt is Australian, based on the Gold Coast, which means one of the main people explaining an American data breach to the world is a Queenslander. Tasmania will accept this, provided he never describes our weather as "the sunny part of the sunny country". ↩

3. The vanilla slice is load-bearing in this analogy. Any small-town Australian broker of local news who does not sell a vanilla slice is operating outside the industry standard. ↩

4. The FTC report also lists segments such as "Rural Everlasting", which it describes as single men and women over 66 with "low educational attainment and low net worths". Nobody in that segment chose the name, and none of them were asked. ↩

5. Comparing every pair in a file of N records takes about N² ÷ 2 comparisons. For 2.7 billion rows, that is roughly 3.6 quintillion comparisons, which is why blocking exists. I have not counted the sand on Bruny Island, but I am comfortable with the comparison. ↩

6. In the capture of 13 July 2024, the sentence beginning "Accordingly, we may continue to collect" appears twice in a row, as if once was not firm enough. The same page also opens with a stray line of template text about "a solid SEO strategy", which tells you how carefully the opt-out page was maintained. ↩