You probably heard about the NationalPublicData.com breach many times in the last few weeks. If you don't remember it by that name, you probably remember talk of every social security number in the world being hacked.
The news media latched onto this because of its wow factor. It was easy to headline this and grab attention without giving many details. That's fitting for mainstream news. Quick sound bites to keep you tuned in.
Fortunately, we have investigative reporters who will dig further. Unfortunately, you've long forgotten about this story by the time their analysis is published.
In this story, you learned that numerous social security numbers were breached with some associated data (e.g., names, addresses, email addresses, etc.). That would certainly constitute a breach of PII (personally identifiable information) and be cause for concern.
What they didn't report was that later analysis showed many of these records represented the oldest among us and several were most certainly deceased. "Atlas discovered that many of the records related to people who are now almost certainly deceased. They found the average age of the consumer in these records is 70, and fully two million records are related to people whose date of birth would make them more than 120 years old today."
They also didn't tell you how little weight most institutions put on having only this information. As a military veteran, it's almost laughable how many times my social security number has been stolen from government databases. It was alarming the first time, in the Air Force Personnel Center breach of 2005, but less concerned the umpteenth time in 2015 when the Office of Personnel Management was breached.
Why? Because the importance of the social security number has been actively minimized over the years. In the past, the SSN was used as a primary key in almost every employment and financial database out there. We put too many eggs in that one basket, but have learned to get some more baskets since then. We still use it for verification, but along with many other data points before granting any sensitive access.
We aren't saying that you should blow off all these reports. We just want to nullify the effects of the sensationalism attempts and get thinking more about what appropriate actions you can take. Don't just cry wolf, but build yourself a brick house he can't blow down. So, what should you do?
- Look for more in-depth analysis of these headline-only reports. Dig into the specifics and the recommendations.
- Look for guidance from people in-the-know: industry experts, cybersecurity experts, financial experts, etc.
- Keep a closer eye on your finances at all times.
- Put that credit freeze on your records at the three credit agencies.
- Review your credit report frequently.
- Monitor mail, email, and your banks for odd occurrences that could indicate fraud.
- Talk to family and friends about doing the same. Look out for your kids, parents, and grandparents, as well.
Bottom line: these mainstream news stories aren't meant to help you, but just rile you up with fear and sensationalism. You can help yourself, though, by digging deeper to find the helpful information and recommended protective actions.
