Nightmare Record Check Data Breach
A recent data leak from a third-party record-checking firm highlights the long-term risks of storing sensitive information outside secure police networks, bringing into the spotlight, record check security.
National Public Data (NPD) is a U.S.-based company that performs background checks for employees and volunteers on behalf of employers and organizations. It aggregates data from multiple sources, including background check results, and is affiliated with RecordsCheck.net, a site that hosts and manages online record check requests for public clients and police departments.
In August 2024, NPD disclosed a significant data breach, where hackers accessed millions of records, including names, emails, phone numbers, Social Security numbers, and addresses, spanning decades of data. The breach exposed 137 million email addresses and 272 million Social Security numbers, affecting both current records and those of deceased individuals.
This breach raised serious concerns, as RecordsCheck.net had used weak default passwords that many users hadn’t updated, leaving accounts vulnerable to attacks. Individuals impacted by the breach now face heightened risks of identity theft, prompting them to freeze credit, monitor credit reports, and engage financial monitoring services.
This record check security incident underscores the risks of outsourcing data storage to third parties, as large volumes of stolen data were leaked publicly online. According to KrebsOnSecurity, NPD and RecordsCheck.net compounded the issue by hosting archives with loosely protected usernames and passwords, along with login details.
Information compromised through a data broker, makes it difficult to verify its source and authenticity, and individuals affected are frequently unaware that their data was at risk in the first place.
When it comes to record check security, these risks emphasize the necessity for regulatory frameworks that enforce robust data protection standards, transparency obligations, and clear accountability for companies handling personal data.
Agile Records, by contrast, does not store public or law enforcement record-check requests or results online. All data is securely stored in police databases behind police firewalls, adhering strictly to law enforcement security protocols.
A lawsuit has since been filed against NPD.
For further information on data breach risks, visit Wired’s Guide to Data Breaches.