In August 2024, a background check company called National Public Data confirmed one of the largest data breaches in history. Names, addresses, phone numbers, and Social Security numbers for nearly 3 billion records were leaked onto the dark web. Not 3 million. Three billion. That’s roughly every person in the United States, Canada, and the UK, with many people appearing multiple times across different database entries.
If you have a Social Security number, there’s a very real chance your information was part of this breach. And that’s just one incident from one company.
The Breach Problem Is Bigger Than You Think
National Public Data was a headline-grabber because of its scale, but it wasn’t an isolated event. In 2025 alone, there were over 3,200 publicly reported data breaches affecting more than 1.5 billion records. These include healthcare providers, financial institutions, retailers, and government agencies.
The pattern is always the same. A company collects your personal data, stores it in a database, gets hacked, and then sends you a letter six weeks later offering free credit monitoring.
Here’s what most people don’t realize. Your information has probably been exposed in multiple breaches over the past several years. Each breach adds more pieces to the puzzle. One breach leaks your email and password. Another leaks your address and phone number. A third leaks your SSN. Put those together and a thief has everything they need.
How To Check If Your Data Was Exposed
You don’t need to pay anyone to find out. There are several free, legitimate tools that will tell you exactly which breaches included your information.
HaveIBeenPwned.com is the gold standard. Created by security researcher Troy Hunt, this site lets you enter your email address and instantly see every known breach that included it. It covers billions of records across thousands of breaches. The site is trusted by governments and security professionals worldwide.
Check your email first. Go to haveibeenpwned.com and type in every email address you use. Personal, work, old accounts you forgot about. You’ll likely see a list of breaches, and some of them will surprise you.
Check your phone number too. The site recently added phone number lookups, which is especially useful for breaches like National Public Data that indexed records by phone number.
For Social Security number exposure specifically, the process is a bit different. After the National Public Data breach, the website npdbreach.com was set up to let people check if their SSN was included. However, be cautious about entering your SSN on any website. A safer approach is to assume your SSN has been compromised and take protective action regardless.
What To Do If You Find Your Data Was Exposed
Finding out your information was in a breach doesn’t mean someone has used it yet. But it means the information is available for purchase on criminal marketplaces, sometimes for as little as a few dollars per record. Here’s how to protect yourself.
Freeze your credit immediately. This is the single most important step. Contact each bureau directly:
- Equifax: equifax.com/personal/credit-report-services
- Experian: experian.com/freeze
- TransUnion: transunion.com/credit-freeze
Freezing is free, takes about 10 minutes total across all three bureaus, and prevents anyone from opening new credit accounts in your name. You’ll get a PIN to temporarily lift the freeze whenever you need to apply for credit yourself.
Change passwords for any breached accounts. If HaveIBeenPwned shows that a specific service was breached, change your password for that site immediately. If you used that same password anywhere else (and be honest with yourself here), change it everywhere.
Enable two-factor authentication. Turn on 2FA for every account that offers it, especially email, banking, and social media. Use an authenticator app like Google Authenticator or Authy rather than SMS codes, since phone numbers can be hijacked through SIM swapping.
Set up an IRS Identity Protection PIN. Visit irs.gov/ippin to get a unique PIN that prevents anyone from filing a tax return using your Social Security number. This takes about 15 minutes and protects you every filing season going forward.
Monitor your credit reports. Go to AnnualCreditReport.com, where you can pull free reports weekly from all three bureaus. Look for accounts you don’t recognize, addresses you’ve never lived at, and inquiries from lenders you never contacted.
The Uncomfortable Reality
Your personal data is almost certainly already out there. Between the National Public Data breach, the Equifax breach in 2017 (147 million people), the T-Mobile breaches, the Change Healthcare breach, and thousands of smaller incidents, the question isn’t whether your data has been exposed. It’s how many times.
That sounds grim, but there’s a practical upside to accepting this reality. You stop relying on companies to protect your data and start protecting yourself. A credit freeze, strong unique passwords, two-factor authentication, and regular monitoring of your accounts and credit reports. These steps take less than an hour total, and they make you a significantly harder target than someone who assumes everything is fine.
You can’t undo a data breach. But you can make stolen data much less useful to the people who have it.
