Democratic Congressman Ritchie Torres (NY-15) released an investigative report on Tuesday, Sept. 10, in which it was confirmed that several Bronx elected leaders had personal data, which was held with National Public Data, a private company that runs background checks, breached. Torres, who represents a large section of The Bronx stretching from the northwest to the South Bronx, said the report confirms that up to 33.3% of Bronx council members, 70% of Bronx assembly members, 66.6% of Bronx state senators, and 100% of Bronx U.S. representatives had their data breached.

 

An excerpt from the report reads, “A cybercriminal gang, operating under the alias of USDoD, stole a massive database from National Public Data (NPD), and then on April 8th, 2024, the cyber gang published it on a Dark Web forum entitled ‘Breached.’ USDoD, which may have breached National Public Data [NPD] as far back as December 2023, offered to sell 2.9 billion rows of records for $3.5 million.

 

Torres said, in part, “A company like NPD is known as a data aggregator or data broker. National Public Data had a massive database stolen, a database containing 2.9 billion rows of private records. Among those private records are the social security numbers of millions of Americans. I write not only as a United States Congressman, but as a victim of the NPD breach. I am among the millions of Americans whose social security number has been stolen…”

 

He continued, “The conduct of National Personal [Public] Data has been so egregious that it all but rises to the level of corporate malfeasance. In early August, a class action lawsuit was filed against Jericho Pictures, which owns and operates NPD. Only after the lawsuit did National Public Data finally admit there had been a breach as far back as December and a leak in both April and August.”

 

The congressman went on to say, “If the breach dates as far back as December and the leak as far back as April, why would National Public Data go four to eight months without disclosing the breach to the general public? Why would it go four to eight months without disclosing the breach to the victims whose social security numbers were stolen? Why would NPD leave millions of Americans wide open to identity theft? NPD has some explaining to do.”

 

He added, “The NPD data breach is as definitive a sign as any that data aggregators and brokers cannot be trusted to police themselves. What is needed, now more than ever, is a federal data privacy law that brings law and order to the lawlessness and disorder of cyberspace.”

 

Torres concluded, “In a properly functioning world, Congress would pass a law establishing comprehensive federal standards of data privacy, as it came close to doing before falling short.  At a bare minimum, Congress should pass a law prohibiting data aggregators and data brokers from collecting social security information whose leakage has put millions of Americans at risk of identity theft.  As George Santayana once said, ‘Those who fail to learn from history are doomed to repeat.’  The time has come for Congress to legislate lessons learned.”

 

We asked the congressman’s office if the breach involved both Democratic and Republican elected officials and a representative said, “This is for all electeds.”

A extract from a notice in relation to the data security incident on NPD’s website is included below.

 

What Happened?
There appears to have been a data security incident that may have involved some of your personal information. The incident is believed to have involved a third-party bad actor that was trying to hack into data in late December 2023, with potential leaks of certain data in April 2024 and summer 2024. We conducted an investigation and subsequent information has come to light. What Information Was Involved? The information that was suspected of being breached contained name, email address, phone number, social security number, and mailing address(es).

 

What We Are Doing
We cooperated with law enforcement and governmental investigators and conducted a review of the potentially affected records and will try to notify you if there are further significant developments applicable to you. We have also implemented additional security measures in efforts to prevent the reoccurrence of such a breach and to protect our systems.

 

What You Can Do
We are notifying you so that you can take action which will assist to minimize or eliminate potential harm. We strongly advise you to take preventive measures to help prevent and detect any misuse of your information. As a first step, we recommend that you closely monitor your financial accounts and if you see any unauthorized activity, you should promptly contact your financial institution. As a second step, you may want to contact the three U.S. credit reporting agencies (Equifax, Experian, and TransUnion) to obtain a free credit report from each by calling 1.877.322.8228 or by logging onto www.annualcreditreport.com. It is also recommended that you place a free fraud alert on your credit file. A fraud alert tells creditors to contact you before they open any new accounts or change your existing accounts. Contact any one of the three major credit bureaus. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts. The initial fraud alert stays on your credit report for one year. You can renew it after one year.

 

Equifax: equifax.com/personal/credit-report-services or 1-800-685-1111

Experian: experian.com/help or 1-888-397-3742

TransUnion: transunion.com/credit-help or 1-888-909-8872

 

Ask each credit bureau to send you a free credit report after it places a fraud alert on your file. Review your credit reports for accounts and inquiries you do not recognize. These can be signs of identity theft. If your personal information has been misused, visit the FTCs site at IdentityTheft.gov to report the identity theft and get recovery steps. Even if you do not find any suspicious activity on your initial credit reports, it is recommended that you check your credit reports periodically so you can spot problems and address them quickly. You may also want to consider placing a free credit freeze. A credit freeze means potential creditors cannot get your credit report. That makes it less likely that an identity thief can open new accounts in your name. To place a freeze, contact each of the major credit bureaus at the links or phone numbers above. A freeze remains in place until you ask the credit bureau to temporarily lift it or remove it.

 

We have reached out to NPD for comment on the congressman’s report and will share any updates we receive.

 

The report can be read in full here.