Massive Data Breach: 2.9 Billion Records and What Your Business Should Do (Updated 2026)

What the 2.9 Billion Record Breach Was, and Why It Still Matters in 2026

A Florida data broker called National Public Data sat on a quiet, sprawling pile of personal records. Names, addresses, phone numbers, dates of birth, and Social Security numbers, scraped or purchased over many years. Then, in April 2024, a hacker group using the alias USDoD posted that pile on a dark web forum and asked for $3.5 million.

By August 2024, a class-action lawsuit forced National Public Data to confirm what security researchers already suspected. Up to 2.9 billion rows. Around 170 million people in the United States, the United Kingdom, and Canada. About 272 million unique Social Security numbers and roughly 137 million unique email addresses, according to IBM’s reporting.

So why bring this up two years later? Because Social Security numbers do not get rotated like passwords. Once your SSN is on the dark web, it stays there. Criminals use those numbers for years, often layering them with new phishing campaigns, synthetic identity fraud, and tax refund scams. And in 2026, the same data is still circulating. A 2026 UpGuard discovery of an exposed Elastic database with 2.7 billion SSNs and 3 billion email and password pairs shows how often this stolen material gets recycled.

For Michigan companies, especially in healthcare, manufacturing, and professional services, the question is not whether your employees were exposed. The honest answer is, almost certainly yes. The real question is what your business does about it.

Why 2026 is the year the bill comes due

Stolen credentials and identity records often sit unused for 12 to 24 months while criminals build automated tooling, set up money mule networks, and refine social engineering scripts. So the wave of secondary fraud usually peaks two years after a major dump. And we are right in that window now. Identity theft complaint volumes climbed sharply through late 2025, and Michigan small business clients are reporting more sophisticated phishing pretexts than ever. The 2024 dump is still doing damage in 2026, and pretending otherwise is a budget mistake.

The 2026 Data Breach Cost Picture

Breach costs keep climbing in the United States even as the global average dips. So a single incident can crater a small Michigan firm. Look at the numbers from the latest IBM Cost of a Data Breach Report and small business research.

• The U.S. average reached $10.22 million per breach in 2025, up 9 percent year over year.
• Healthcare leads at $7.42 million globally; financial services trail at $5.56 million.
• Small organizations under 500 employees average $3.31 million per incident.
• About 60 percent of small businesses close within six months of a major attack.
• Breaches involving stolen credentials take 292 days on average to identify and contain.

So the math is brutal for a small or mid sized firm. A $3 million event is not survivable for most West Michigan operators without insurance, and even with coverage, downtime and customer churn often outlast the policy payout. Our team works with clients to model that scenario before it happens, not after.

Was Your Data Exposed? A Comparison of Lookup Tools

Several free services let employees check if they show up in known breach databases. None are perfect, but used together they give a reasonable picture. Here is how the most common options stack up.

Encourage your team to use at least two of these. The credit freeze and the IRS IP PIN are the strongest of the bunch because they block the most expensive types of fraud.

Building a Cybersecurity Stack That Actually Works

No single product stops every attack. Real protection comes from layers, with each layer covering the gaps of the others. Here is the stack we recommend for most Michigan small and mid sized businesses, with practical examples for each tier.

Building all six in house is expensive and slow. So most West Michigan firms partner with an MSP or MSSP to fill the gaps. That is where our managed IT services come in.

Early Indicators That Your Business Is Already a Target

Stolen Social Security data does not announce itself with sirens. The signs show up quietly, often in HR or finance inboxes, and most teams miss them until the damage lands. So here are the early signals our incident response engineers see most often after a Michigan client lands on a fraud list.

• An IRS notice arrives for an employee whose return has not been filed yet.
• A direct deposit change request comes in from an employee email that looks slightly off.
• A vendor sends a routing number update right before a scheduled payment.
• Someone applies for unemployment benefits in an employee’s name.
• A new credit account appears on an executive’s personal credit report.
• HR receives a verification request for a loan no employee remembers.
• Phishing emails reference real names, real titles, and real project codes.

If you see two or more of these in the same quarter, treat it as a coordinated attempt and not a coincidence. Pull a quick incident response huddle, lock down change processes, and call your MSP.

The first 24 hours after you spot fraud

Speed matters. So your team should know the first hour playbook by heart. Here is the short version we drill with clients across Grand Rapids and the lakeshore.

1. Contain. Reset passwords, revoke sessions, and disable any compromised accounts.
2. Communicate. Notify owners, finance, HR, and your IT or MSP partner with a single message thread.
3. Capture. Save logs, emails, and screenshots before vendors auto delete them.
4. Coordinate. Call your bank, your insurer, and local FBI field office if losses are over a few thousand dollars.
5. Communicate again. File breach notifications under Michigan and federal rules within the legal window.

And practice this twice a year, even if nothing has happened. Tabletop exercises shorten real recovery times by days.

Frequently Asked Questions About the Social Security Number Breach