TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Inside the "3 billion people" national public data breach

588 pointsby bubblehack3r9 months ago

39 comments

throwup2389 months ago
<i>&gt; While the specifics of the data breach remain unclear, the trove of data was put up for sale on the dark web for $3.5 million in April, the complaint reads.</i><p>I guess they failed to sell it because links to the leaked data on usdod.io have been available on Breachforum&#x2F;Leakbase for over a week now. Someone created a magnet link yesterday and it&#x27;s fully seeded so speeds are fast.<p>The data in the breach is irreversibly public now.
评论 #41250018 未加载
评论 #41251142 未加载
评论 #41254235 未加载
评论 #41252669 未加载
d_burfoot9 months ago
It&#x27;s worth remembering that the main reason this kind of data breach is a real problem is mostly due to the incompetence of the IRS. For any <i>serious</i> financial organization, knowing a person&#x27;s SSN, name, address, etc doesn&#x27;t allow you to access or withdraw that person&#x27;s finances.<p>But the stupidity of the IRS means that people are easily targeted by false tax return attacks. File a fake tax return for someone, using their SSN&#x2F;name&#x2F;address, but tell the IRS you changed address. Then the IRS sends your tax refund to the new address, and boom, you just collected some poor sod&#x27;s refund. To add insult to injury, the IRS is probably going to audit the person whose refund you stole.
评论 #41258081 未加载
评论 #41257648 未加载
评论 #41258886 未加载
评论 #41259135 未加载
CrispyKerosene9 months ago
Troy mentions &quot;data opt-out services. Every person who used some sort of data opt-out service was not present.&quot;<p>Anyone have experience with these sort of services? A search brings up a lot of scammy looking results. But if services exist to reduce my profile id be interested.
评论 #41248590 未加载
评论 #41249379 未加载
评论 #41248853 未加载
评论 #41248833 未加载
评论 #41248651 未加载
评论 #41248518 未加载
评论 #41255575 未加载
评论 #41251710 未加载
评论 #41250009 未加载
johnnyballgame9 months ago
Extreme Privacy by Michael Bazzell is a great resource to learn how to limit exposure to these aggregator services.<p><a href="https:&#x2F;&#x2F;inteltechniques.com&#x2F;book7.html" rel="nofollow">https:&#x2F;&#x2F;inteltechniques.com&#x2F;book7.html</a>
blackeyeblitzar9 months ago
It is crazy to me that data brokers are even a legal form of business. All of these services should be opt in at minimum. If they are obtaining publicly available information and making it easier to access, they should have to maintain insurance or a deposit with the government to compensate victims of cybersecurity incidents. Telling people to get credit monitoring is in NO WAY an acceptable way to make us whole. They need to pay for a lifetime of monitoring and INSURANCE up to the net worth of affected individuals. This needs to become law ASAP.
评论 #41249150 未加载
评论 #41250090 未加载
datadrivenangel9 months ago
&quot;there were no email addresses in the social security number files. If you find yourself in this data breach via HIBP, there&#x27;s no evidence your SSN was leaked, and if you&#x27;re in the same boat as me, the data next to your record may not even be correct. &quot;<p>Seems like Troy is skeptical about this being a real full breach?
评论 #41249072 未加载
评论 #41254281 未加载
评论 #41254160 未加载
评论 #41252380 未加载
EvanAnderson9 months ago
For years I&#x27;ve said the entire SSN database just needs to be published alongside legislation strictly assigning liability to any company who defrauded as a result of using the SSN as a &quot;secret&quot;. That would fix the problem with SSN&#x27;s and &quot;identity theft&quot; quickly.<p>Part 1 has been accomplished. Let&#x27;s get part 2 going!<p>Aside: It amazes me how the American public has allowed defrauded companies to assign the company&#x27;s loss as a liability to innocent individuals (in the form of &quot;identity theft&quot;). It would be great if we could get that changed in the minds of the public. A well-informed public could collectively turn &quot;identity theft&quot; into the &quot;bank&#x27;s problem&quot; (from the old adage &quot;If you owe the bank a billion dollars they have a problem...&quot;). The insurance industry would swoop in as the defrauded parties start making claims and shoddy security practices would get tightened-up.<p>(Edit: I fear insurance companies coming in to &quot;fix this&quot; to some extent-- citing my experiences with PCI DSS compliance auditing and Customers who have had &#x27;cyber insurance&#x27; policies coming with ridiculous security theatre requirements. Maybe we can end up with something like a &#x27;cyber&#x27; Underwriters Labs in the end.)<p>(Also: Yikes! I hate that I just typed &#x27;cyber&#x27; un-ironically.)
评论 #41250337 未加载
评论 #41250292 未加载
评论 #41254129 未加载
评论 #41253500 未加载
评论 #41250576 未加载
评论 #41255032 未加载
评论 #41250538 未加载
quantumfissure9 months ago
For non-Americans (and Americans) that don&#x27;t quite understand what SSN is and why it&#x27;s a problem, CGP Grey [1] has a great (and short) video about the history and why it&#x27;s not technically an identifier, but has become one.<p>[1] <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=Erp8IAUouus" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=Erp8IAUouus</a>
评论 #41252258 未加载
评论 #41250072 未加载
评论 #41249524 未加载
评论 #41252062 未加载
left-struck9 months ago
&gt; The problem with verifying breaches sourced from data aggregators is that nobody willingly - knowingly - provides their data to them<p>This is a bit of a tangent but I feel like if we can prove this statement then these data aggregators should be made illegal. How can you consent to something that you don’t know you’re consenting to? Likewise why do these entities have the right to collect detailed personal information like SSN without your explicit, beyond reasonable doubt, consent? To me this is the most obvious failure of the legal system, it clearly goes against well established legal principles that a basic requirement of an agreement is that all parties know what they are agreeing to.<p>Obviously there is some leeway with agreements where it’s not possible to clarify every eventuality but lets say if you’re applying to rent a place through an online form and that form shares your SSN to a data aggregator, it should be extremely clear about that, and possible to out out while still allowing you to complete the rental application without discrimination.<p>It’s like, it should be possible to show that no one, with in reason, consented to sharing their data with this aggregator because no one is able to confirm that they did. Sure one person could forget, or lie, but 100s of millions of people? No. Clearly almost zero people knowingly consents.
评论 #41252858 未加载
评论 #41254146 未加载
评论 #41251939 未加载
araes9 months ago
I was wondering why Google suddenly turned on &quot;prompt authentication&quot; on zero-security feature accounts yesterday. Now I &quot;must&quot; have a phone nearby to use Gmail... Tap to authenticate every time you want to look at ... ad spam.<p>With this, Ticketmaster, and the CDK Global car theft, is there anybody on Earth who doesn&#x27;t need data protection? Poor people in Somalia need data breach notices. People who are not even on the WWW need data breach notices...
esmeraldametteo9 months ago
I recently hired the experts of {hacker11tech (@) gmail com} to help me track my spouse&#x27;s GPS location, as I suspected infidelity. They provided me with accurate and timely information, revealing that my spouse was frequently visiting another person&#x27;s location instead of going to work as claimed. Their expertise and professionalism were very impressive, and their ethical approach ensured a discreet and confidential process. The evidence gathered was comprehensible and reliable, giving me clarity that I needed to address the situation. I highly appreciate the {hacker11tech (@) gmail com} dedication helping to uncover the truth while maintaining ethical standards, their services was valuable in helping me make decisions about my relationship. I highly recommend this team {hacker11tech (@) gmail com} for anyone seeking reliable ethical practices and their commitment is reassuring.
hn727749 months ago
Anything the average SSN holder should be doing proactively?
评论 #41256513 未加载
评论 #41259228 未加载
blindriver9 months ago
Why are data aggregators legal? In California can we create a proposition to shut them down in the state?
idontknowtech9 months ago
This sort of stuff will continue happening until the regulatory framework acknowledges a fundamental consumer right to privacy.<p>If a data broker collects data without the consent of the consumer, then their only real risk is a class action lawsuit which drags on for six years, gets settled for a few days profit, and the consumer gets $13.50 after the legal fees. This massive skew in the risk reward calculus of data brokers is why we have the problem. Because there&#x27;s little to no real downside, the trend is automatically collect as much data on as many people as possible.<p>Fixing this means big, mandatory, cash penalties in the law code - say $5k per consumer data leak, directly to the affected consumer, with added penalties if the company lies about the leak or delays payment. The fine must be big, mandatory, and paid directly to the consumer. Only that changes the risk reward ratio.<p>In that new world, companies would have to re assess their risks. They&#x27;d either build invulnerable systems and hire a lot more people reading HN to protect their golden goose, or better still they&#x27;d decide to exit the business entirely. That sounds bad, but the only reason the industry exists is because regulators failed to foresee massive leaks like this happening every three months.<p>We need a consumer data privacy law, with massive fines, to force companies to change their behavior. What we&#x27;re doing now clearly does not work.
评论 #41252442 未加载
评论 #41252453 未加载
dimgl9 months ago
I used Robokiller to remove myself from data broker lists. I&#x27;m extremely impressed with it. I pay yearly. My only annoyance with Robokiller is that<p>A) It&#x27;s necessary. When is the government going to start creating laws to help us and prosecute this?<p>B) It&#x27;s expensive. Most people cannot afford this. I can barely afford it but my information has been leaked online.<p>C) It&#x27;s inconvenient. A majority of calls are spam, but I&#x27;ll often miss important calls from unknown numbers because Robokiller acts as a proxy and for some reason the call is routed through the Internet.<p>Anyhow, my wife and I are not on this list. I&#x27;m wondering if using Robokiller saved us from a lot of pain here.
velcrovan9 months ago
Even before this, anyone operating a service who isn&#x27;t treating SSNs as public knowledge in 2024 needs to be, well, shamed or penalized or something.
uticus9 months ago
I’ve finally figured out the play: war of attrition.<p>Eventually enough data will be leaked to make moot the benefits of securing any personal data. At that point everyone stops trying and moves on to more financially rewarding activities.<p>I mean even if I’m an elephant, and data breaches are blind men, eventually enough blind men will draw a true comprehensive picture.
puzzledobserver9 months ago
Several other commenters have brought about the sneaky wordplay involved in saying &quot;identity theft&quot; instead of simply calling it &quot;fraud on the bank&quot;, and somehow turning the person into the victim rather than the bank that has been defrauded.<p>Has anyone tried to argue this point in court? Has this survived &#x2F; how did this terminology shift survive judicial scrutiny?
fnord779 months ago
From the NPD website:<p>&gt; Please be advised that we will not collect, use, disclose, sell, or share the sensitive personal information or sensitive data of California, Virginia, Colorado, or Connecticut residents as those terms are defined by the CCPA&#x2F;CPRA, VCDPA, CPA, or CTDPA, respectively.
评论 #41251783 未加载
hypeatei9 months ago
Does anyone else just not give a fuck at this point about their SSN? I feel like maybe early 00s this would be scary but it&#x27;s clear that everyone&#x27;s SSN is out there already or waiting to get breached from a shady private data broker.<p>The problem lies in how institutions treat the SSN, not the number itself.
评论 #41249320 未加载
评论 #41249088 未加载
janalsncm9 months ago
Are there any ways to check the breach to see if my information is there, other than downloading it myself? I’m not sure of the legality of doing so.
评论 #41250684 未加载
评论 #41250610 未加载
29athrowaway9 months ago
Time for services everywhere to stop using SSNs for identification and for the US to move on to a more advanced form of identification.<p>And lock your credit.
评论 #41249294 未加载
评论 #41248970 未加载
itamblyn9 months ago
Is there a straightforward way to download this file for research purposes?
sergiotapia9 months ago
Downloaded the torrent, and it&#x27;s a 164GB text file.<p>What&#x27;s a quick way to search if my SSN is in the file? I ask before diving in, it&#x27;s currently extracting and ETA is 40 minutes.
评论 #41255137 未加载
评论 #41255202 未加载
NoMoreNicksLeft9 months ago
Can&#x27;t the SSA just issue 330 million new social security numbers, and tell people to be more careful with them from this point forward?
评论 #41249474 未加载
评论 #41249120 未加载
smcin9 months ago
Discussion from last week: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=41184420">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=41184420</a>
seydor9 months ago
What if we just made all this data free , some AI is going to compile them anyway (and probably already has). Deterrence is the best defense, right ?
评论 #41254169 未加载
JumpCrisscross9 months ago
“The database DOES NOT contain information from individuals who use data opt-out services. Every person who used some sort of data opt-out service was not present.”<p>Like what?
peterbecich9 months ago
i.m.o. &quot;National Public Data&quot; in title should be capitalized; it is a proper noun <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;National_Public_Data" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;National_Public_Data</a>
jpcookie9 months ago
And where is this information that this random group supposedly has? I have yet to see proof of that being real
评论 #41252176 未加载
评论 #41251260 未加载
评论 #41249600 未加载
luxuryballs9 months ago
the government should have put out honey pots or something, or maybe it’s time to get new numbers and just invalidate all the stolen data, there is clearly money for fixing this kind of thing but they’re using it to spy on us and do who knows what else instead
USDoD9 months ago
Does anyone know the correct password?
farceSpherule9 months ago
I worked incident response for years, logging thousands of hours of actual on site work with impacted clients.<p>No on cares.<p>Clients see this as the cost of doing business and have no incentive to do better. Even after Equifax and OPM.<p>Until we have a GDPR style law in the U.S. it will continue to be status quo.
tmaly9 months ago
I sure wish the US had a version of GDPR.<p>I get a data breach notice at least a few times a year. I got one for my kids two months ago for their medical data. I thought HIPPA had huge penalties but I guess not.
评论 #41249834 未加载
robustcollector9 months ago
Perhaps HN readers would appreciate a detailed account of what the NPD torrents contain.<p>The torrent deliver two files like so:<p><pre><code> NPD202401.7z 33,456,912,010 bytes (32GB) NPD202402.7z 20,548,499,322 bytes (20GB) </code></pre> Uncompressing NPD202401.7z results in:<p><pre><code> ssn.txt 176,806,109,779 bytes (165GB) wc -l ssn.txt ==&gt;&gt; 1,698,302,005 lines </code></pre> Uncompressing NPD202402.7z results in:<p><pre><code> ssn2.txt 120,722,361,611 bytes (113GB) wc -l ssn2.txt ==&gt;&gt; 997,379,508 lines </code></pre> This is a total of 1698302005+997379508 = 2,695,681,513 lines.<p>Each line is a comma separated record with these fields:<p>ID,firstname,lastname,middlename,name_suff,dob,address,city,county_name,st,zip,phone1,aka1fullname,aka2fullname,aka3fullname,StartDat,alt1DOB,alt2DOB,alt3DOB,ssn<p>Generally records have ID, firstname, lastname, middlename, address, city, county_name, st, zip, and ssn. Most records do not have the fields for name_suff (name suffix), phone1, aka1fullname, aka2fullname, aka3fullname, StartDat, alt1DOB, alt2DOB, and alt3DOB.<p>There are no emails at all. There is no &quot;@&quot; in the files anywhere. Phone numbers are very rare.<p>I don&#x27;t know what the ID number at the head of each line represents. I presume it is an internal index used by the organization that compiled the data. The SSN is at the end of each line.<p>The files have U.S. addresses only as far as I can tell. Nothing from Mexico, Canada, or other foreign countries.<p>Many of the lines (records) concern the same person at various addresses. Of 7 random people who I personally know that I checked on, all had entries. There were between 3 and 20 lines (records) for these 7 persons, averaging about 10. They usually differed only in the address field. Going by an estimate of 10 records per person, the 2.6 billion lines represents about 2695681513&#x2F;10 = 269,568,151 distinct persons in the U.S.<p>The U.S. population is about 337M where 78% is over 18 years of age. In other words, 337000000*0.78 = 262,860,000 Americans are adults. This is pretty close to my estimate of 269,568,151 distinct individuals in the NPD data files.<p>Of the 7 persons I checked on, the names were spelled correctly, although the middle name was sometimes just an initial. I searched each person by multiple methods (address, last name, birth date) so I believe I would have detected names that were spelled slightly wrong.<p>The addresses appeared correct but there was no way to tell which was the current address and the order in which they lived at each address. There is a StartDat field but it was almost never filled in. The latest entry was not always the most current address. In a couple cases, the current address, where the person has been living for several years, was absent.<p>The birth dates were correct in a couple cases, were abbreviated in three cases (that is, instead of showing 19800704, meaning July 4 1980, it showed 19800700, meaning July 1980 without an exact day), and was wrong for one person by a wide margin.<p>All 7 persons I checked had SSN numbers. It was correct for 1 person but I don&#x27;t know for the other 6. The SSN numbers were consistent for each of the 7 persons I checked on. By this I mean that a person did not have more than 1 SSN number, at least among the 7 persons I checked on.
albert_e9 months ago
off topic<p>does HIBP automatically cover plus addressing variants of an email<p>example I submit johndoe@example.com<p>but a breach had johndoe+verizon@example.com<p>will it match
评论 #41254204 未加载
评论 #41253310 未加载
toomuchtodo9 months ago
Ahh, cool, pour the corpus through GPTs and start tweeting Congressional rep personal info at them until they pass a law to outlaw data brokers (in keeping with historical precedent [1] [2]).<p>[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Video_Privacy_Protection_Act" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Video_Privacy_Protection_Act</a><p>[2] <a href="https:&#x2F;&#x2F;jolt.law.harvard.edu&#x2F;digest&#x2F;dodging-the-thought-police-privacy-of-online-video-and-other-content-under-the-bork-bill" rel="nofollow">https:&#x2F;&#x2F;jolt.law.harvard.edu&#x2F;digest&#x2F;dodging-the-thought-poli...</a>
评论 #41250032 未加载
评论 #41253343 未加载
评论 #41253060 未加载
评论 #41250726 未加载
评论 #41253313 未加载
ghm21809 months ago
I am just dreading the day when a near simultaneous cyberattack on a high number of(more vulnerable like middle-lower income individuals) start in a DDoS fashion:<p>1. Credit histories will be(unlocked) used to file multiple credit applications and tax credits will be applied for.<p>2. Multiple Cell phones will be hijacked through Sim Hijacking or other zeroday attacks to make it very difficult to get back in.<p>3. A person&#x27;s profile will be used to attack the most vulnerable things: - Their families will get fake calls to create confusion. - Their financial services will be frozen or worst weak 2fac auth ones will be compromised.<p>4. Deep fake image and videos will be created from compromised accounts to sow further mayhem.<p>This already happens in targeted and one startegy of teh other fashion. Imagine what one could do with a bit more compute and completed profiles and orchestrate this kind of terrible vengeance.
评论 #41251251 未加载
评论 #41251267 未加载
评论 #41250793 未加载
评论 #41251849 未加载
评论 #41250768 未加载
评论 #41251940 未加载
layer89 months ago
TL;DR:<p>&gt; an intriguing story that doesn&#x27;t require any further action.