Major data leak in “national public space” – worse than expected because passwords were stored in plain text

Earlier this month, data broker National Public Data (NPD) announced that it had suffered a major data breach in which hackers had stolen millions of names, email addresses, phone numbers, social security numbers and mailing addresses from its database. NPD is a company that conducts background checks on employees, collects and sells public data from numerous sources.

The NPD’s security measures were obviously inadequate to make the break-in possible, but a new report by KrebsOnSecurity suggests that a sister site of the NPD made an even more serious mistake by hosting an easily accessible plain-text archive of usernames and passwords.

RecordsCheck.net, an NPD-affiliated site that hosts much of the same information, had a “members.zip” file available for download until yesterday. It contained source code and plain-text usernames and passwords for RecordsCheck users, including logins for NPD founder Salvatore Verini. The logins made available through RecordsCheck provided access to the same data available through NPD.

After an alert from KrebsOnSecurity, RecordsCheck removed the file and NPD shut down the site, according to Verini. He told KrebsOnSecurity that the file contained an “old version of the site with non-working code and passwords.”

There are various websites where you can check whether your data was stolen as part of the NPD breach. It is advisable to block your credit rating.

The NPD leak contained information from several decades, including data from people who have since died. 137 million email addresses and 272 million social security numbers were leaked. A lawsuit has now been filed against the NPD.