National Public Data Breach Exposes Identity Theft Risks and Data Broker Security Failures
· 47:50 · Watch on YouTube ↗
Summary
Darknet Diaries traces the reported National Public Data breach to exposed admin credentials and password reuse, describing 2.9 billion stolen records, identity theft risks and USDoD’s subsequent arrest in Brazil.
Key points
- The episode reports that USDoD found a publicly accessible members.zip archive on Records Check containing source code and administrator credentials.
- According to the account, password reuse enabled access to National Public Data, where USDoD stole 277 GB containing 2.9 billion lines of records and offered the data for $3.5 million.
- Exposed information reportedly included names, birth dates, Social Security numbers, addresses, email addresses and phone numbers in plain text; the transcript notes that some records contained errors.
- The episode describes USDoD impersonating a CEO to join InfraGard, then using a Python script to collect contact information for 80,000 members through its API.
- The host reports that Brazilian police arrested USDoD, identified as Luan Barbosa; his prison sentence remains unclear in the transcript.
- National Public Data reportedly faced multiple class-action lawsuits but continued operating; the host describes its purported sale to Perfect Privacy LLC with uncertainty.
- The episode connects large-scale personal-data exposure to identity theft and recommends encrypted messaging, encrypted email and privacy-focused browsing.
Article Details
- Topics
- [00:00] Identity theft and the wrongful imprisonment of William Woods
- [10:32] USDoD’s reported hacking history and military-data theft
- [17:20] InfraGard impersonation and API-based member-data collection
- [26:05] Data brokers, social media scraping and government access to personal information
- [32:03] Exposed credentials and password reuse in the National Public Data breach
- [35:28] Personal-data exposure and downstream identity theft risks
- [39:51] USDoD’s identification and arrest, and National Public Data’s legal aftermath
- [43:13] Privacy legislation and recommended personal privacy measures
MITRE ATT&CK
T1059.006 · PythonUSDoD reportedly used a Python script written by an associate to collect InfraGard members’ contact information through its API.T1078 · Valid AccountsThe transcript reports that USDoD used recovered administrator credentials to access Records Check and reused credentials to access National Public Data.T1552.001 · Credentials In FilesUSDoD reportedly recovered administrator credentials embedded in source code inside a publicly accessible members.zip archive on Records Check.T1589 · Gather Victim Identity InformationThe episode describes USDoD searching leaked datasets for personal information and identities to impersonate when accessing target organizations.
People
Jack RhysiderHost who describes direct social-media interactions with USDoD and observing his public claims before the account disappeared.Salvatore Verini Jr.Described as the operator of Records Check, Criminal Screen and National Public Data. The episode attributes the breach to exposed credentials and password reuse and reports subsequent lawsuits.William WoodsIdentity theft victim whose wrongful imprisonment and eventual exoneration are described as an illustration of the harm caused by identity misuse.
Threat Actors
Luan BarbosaIdentified by the episode as the individual using the name USDoD, to whom it attributes impersonation-based intrusions and National Public Data theft. The transcript reports his arrest in Brazil but says his sentence is unclear.UsDoDThe episode attributes InfraGard data theft and the National Public Data breach and data-sale offer to this operator. It identifies USDoD as Luan Barbosa and reports his arrest in Brazil; some earlier stories and hacking claims are explicitly described as uncertain.
Products
Brave[44:53] and sent to Google. They want to know everything about you. So, I use the Brave browser, whichInfraGard[17:20] USDoD didn't stop there. He went on a roll after that. His next target was InfraGard.National Public Data[29:17] Records Check, Criminal Screen, and the flagship site, National Public Data.Proton[44:32] The same goes for end-to-end encrypted e-mail providers like Proton or Tuta. They cannot seeRecords Check[29:17] Records Check, Criminal Screen, and the flagship site, National Public Data.Signal[44:23] by phone companies. So, a chat app like Signal takes extreme steps to never be able to see chats.Tuta[44:32] The same goes for end-to-end encrypted e-mail providers like Proton or Tuta. They cannot see