Last year, the National Public Data (NPD) platform collapsed in disgrace after one of the biggest data breaches in history. The breach exposed billions of records containing names, addresses, phone numbers, dates of birth, and Social Security numbers – a motherlode of sensitive information that left millions of Americans at risk of identity theft. In the aftermath, its parent company filed for bankruptcy, and many assumed NPD was gone for good.
But it’s back. Under new ownership, NPD has relaunched, once again offering access to detailed background information about individuals. Privacy experts are raising alarms that its return could set off another wave of scams and phishing attacks.
Why the Comeback Is Concerning
The first time NPD made headlines, it was because hackers published a treasure trove of its records online. I covered the breach at the time and saw firsthand just how much data was exposed. When I searched my own details, I found decades of my information freely available – from past addresses to phone numbers I barely remembered. That sort of data history doesn’t just disappear.
What makes the reappearance of NPD especially worrying is how the data can be misused. As Karolis Arbaciauskas of NordPass explains, the site doesn’t just contain information about you – it can also include details about your family, friends, and even neighbors. When hackers have access to that web of relationships, they can craft scams that look frighteningly real. Imagine getting a message that mentions your spouse by name or references the street you grew up on. That’s the kind of context that tricks even cautious people into clicking links or giving up more personal information.
Read more: Data Brokers Can Keep Selling Your Info Unchecked, Thanks to the CFPB
The Real Threat: Social Engineering
Unlike brute-force hacks that exploit technical flaws, the bigger danger here is social engineering. Criminals know that fear and confusion can make people act against their better judgment. If you get an email that appears to be from your bank – or worse, from law enforcement – it’s natural to panic. But the links in those emails often lead to fake sites designed to steal even more of your data.
That’s why it’s so important to stay skeptical. If you receive a suspicious message, don’t click the link. Instead, go directly to the company’s website or call them using the phone number on the back of your bank or credit card. And remember: legitimate organizations won’t pressure you with threats or promises of instant rewards (or punishments).
Read more: How Security Expert Troy Hunt Got Phished – and Why 2FA Didn’t Save Him
What You Can Do
The first step, if you find your information on NPD, is to request removal from the site.
- Search for your information on the National Public Data website.
- Click on the “View the Full Profile” button. Copy the URL of your full profile page.
- Go to NPD’s opt-out page and paste in the URL of your full profile page.
- You need to provide your email address and click the “Remove” button in the email from NPD to complete your removal.
Beyond that, with all the past (and likely future) data breaches, you should assume that your data is already circulating. These are the protective measures I recommend you put in place:
- Freeze your credit with Equifax, Experian, TransUnion, and Innovis. It’s one of the best defenses against identity theft.
- Use a password manager and strong authentication tools like multi-factor authentication or, better yet, passkeys. They make it much harder for criminals to break into your accounts, even if they have your personal information. I use and recommend 1Password for storing passwords and passkeys.
- Stay calm and skeptical. The most powerful weapon cybercriminals use is our own fear.
The reality is that the data genie is out of the bottle. With so much personal information already leaked, NPD’s return just makes an already dire situation worse. My advice: act as though your data is out there – because it probably is – and take steps now to protect yourself.
[Image credit: Screenshot via Techlicious, laptop mockup via Canva]
