NerdWallet's Smart Money Podcast - Safeguarding Your Identity After the National Public Data Breach

Episode Date: August 28, 2024

Learn how the National Public Data breach could affect you and what actions you can take after a major data breach occurs. What should you do after a major data breach? How can you secure your data from unscrupulous data brokers? Hosts Sean Pyles and Anna Helhoski discuss the alarming security breach at National Public Data with investigative journalist Bob Sullivan, exploring the implications of the breach and providing actionable tips on how to protect your personal information from future threats. Then, Sean and Anna discuss the latest money headlines, including Fed interest rates, the turbulent real estate market’s challenges posed by high mortgage rates and rising home prices, and the antitrust lawsuit against RealPage for alleged price-fixing in the rental market.  Use NerdWallet’s “How much house can I afford?” calculator: https://www.nerdwallet.com/mortgages/how-much-house-can-i-afford/calculate-affordability  In their conversation, the Nerds discuss: National Public Data breach, Social Security number protection, credit monitoring, interest rate cut, Fed interest rates, housing market trends, mortgage rates, home affordability, real estate market, rent increase, rental market, antitrust lawsuit, financial security, cybersecurity, credit score impact, data protection, mortgage tips, home buying tips, housing prices, RealPage lawsuit, rental software, property management, interest rate prediction, inflation impact, homeownership, financial planning, identity theft, security breach, class action lawsuit, credit report, credit freeze, housing market forecast, fed policy, real estate tips, housing affordability, mortgage rates 2024, and rental prices. To send the Nerds your money questions, call or text the Nerd hotline at 901-730-6373 or email [e-mail].

Welcome to NerdWallet's Smart Money Podcast. I'm Sean Piles. And I'm Anna Hilhoski. And this is our weekly money news roundup, where we break down the latest in the world of finance to help you be smarter with your money. We'll go deep into a single topic and then leave you with the latest money headlines. Today, we're talking about a recent security breach that could have likely exposed your social security number and other private information. To get the scoop on what happened and what it means for you, I spoke with journalist Bob Sullivan, who hosts the Perfect Scam podcast for AARP and is the author of the New York Times bestseller,

Stop Getting Ripped Off. We're joined by journalist Bob Sullivan. Bob, welcome back to the show. Thanks for having me. Okay. So there's this company called National Public Data that, to crib from your own headline about all of this, just essentially made a ton of people's social security numbers public. First of all, yikes. Second, what is this company? Tell us what it does. This is a background employment company. So if you are worried about hiring someone and you want to get a quick snapshot of whether or not they have a criminal record, you hire National Public Data. I had never heard of them before this incident, and I'm sure most of your listeners

hadn't either, which is the thing that really bugs me about all these stories. And we only know about this breach because of a class action lawsuit, right? Yeah, they didn't come forward and confess to it. It actually happened in April by their own admission. They'd been fighting off attacks since last December. The data was stolen in April, and then a class action lawsuit was filed a couple of weeks ago, which brought all this to light. And why did it take a lawsuit for us to find out about this? Didn't the company have a duty to let the public know? It did. And I suppose I should clarify that some of those notification letters had been going out. So individual consumers did get some warning

and that's how the law firm became involved. But it's not like we all got a letter. And as with all of these data leaks, there's still dispute over precisely how many people were affected. But when it's a data set this large, one way or another, we are all affected. So have they had any consequences yet? The company, other than fighting off this lawsuit, no. A lot of embarrassment, I think, and good. As far as the rest of us, though, the consequences, with all these stories, I really like to right size the fear for people. It's terrible that what sounds like every social security number in America has been exposed. But you probably remember the Equifax hack when a very similar thing happened several years ago. So whatever you were doing back then to take care

of yourself should still work now, or maybe you need to just renew those efforts. But this is not a situation where suddenly everyone's bank account is going to be at risk or something like that. This is kind of the normal state of affairs we live in right now. On a regular basis, our data will be stolen and we have to add a little vigilance to what we normally do. So why did this company have that kind of information on all of us? I definitely don't remember giving them any permission to have mine. Yes, this is a very normally do. So why did this company have that kind of information on all of us? I definitely don't remember giving them any permission to have mine. Yes, this is a very good question. And I so often feel like this is the thing that gets glossed over in all these stories. Who the heck is National Public Data? And by the way, I love the name National Public Data because they just made all

of our data public. So thanks to them. But why do they have our information? We never had any kind of a relationship with them, most of us. And so why do they have permission to have it in the first place? And it's because we have this really unregulated soup of companies, most of which we wish didn't exist as consumers that are data brokers who can just buy and trade things about us. First of all, without any benefit to us. I mean, it's our information. It's not like we get paid for it or anything. And second of all, it only does bad things to us. I mean, at a minimum, it caused us to not get a job because there's a mistake in the data that we don't know about.

And we have a situation like this where the data is irresponsibly cared for. There was a story just a couple of days ago that National Public Data actually left passwords to these databases out in the public eye for a hacker to find. And that's probably how this hack occurred. All bad things come from this company having access to your data that you never gave them permission in the first place. So hackers basically got all this information out of national public data and then they put it up for sale for $3.5 million. Also, that sounds like pretty underpriced for Supercharger Trove, but I digress. Do we know if anyone bought the data?

We don't. And, you know, a lot of times those notices are half a joke, for heaven's sake. I mean, when criminals steal this data, the first thing they do is get all the value out of it that they can on their own. And then they look to sort of monetize it in a secondary way. And a lot of times those ads are sort of tongue in cheek. But the real concern that I have is who had the data in the first place? Often it's stolen and then shared among thieves, no honor among thieves, and multiple people represent having it. But there are many people who believe when you put together the OPM hack that happened a couple of years ago and the Equifax hack and this hack and many, many others, that somewhere out there is an entity, a large entity, a big

criminal gang group, probably in nation state, that is amassing this massive database about all of us that's going to be used at some future date. I mean, it's easy to imagine a college student today who 10 years from now is a general in the U.S. Army, and then a foreign nation state can use stolen data like this for blackmail purposes or whatnot. So I think somebody is grabbing up all this data and planning to use it on something really terrible in the future. And I think that's the real concern. All right, let's get to what this means for all of us who were impacted by this particular breach. So first off, how do we even know if we were impacted? You don't really know. There are a couple of websites that say that they have downloaded the data since then.

You can Google them easily. I don't necessarily want to advertise them. And you can input your name and your birthday and see if you were in the data and believe the results that you get if you want to. I think it's just safe to assume that if not this breach, then another one, your social security number is out in the computer underground for sale or for use by someone against you. So does this mean that we should be more closely monitoring our credit reports for a while or just kind of generally always having some kind

of an idea of what's happening in our credit? Yeah, I mean, I think this is just a reminder of the digital hygiene you should always be doing anyway. There's no reason to believe that, say, the next two weeks, you have a heightened likelihood of being hacked or having your identity stolen. I don't think it works that way, especially because the status was actually stolen in April or maybe even before then. So it's not like today there's a red alert. It's more like, here's a reminder. Maybe back in 2017, you put fraud alerts on your credit report and you got better about checking your alerts on your credit report and you got better about checking your bank account once a week and you got a little lax over time. This is a reminder that we all have to do all those things on a pretty regular basis. And I don't want

anybody to be obsessive compulsive about this because there's a lot of things you can do to recover if something bad happens to you. Many people in my line of work will say that the name of the game is really recovery after an incident, not prevention. All of us are going to have our identity stolen in some way or another at some point. So the main thing is when your credit card is used by a criminal, catch it. When an account is opened in your name, find it on your credit report and deal with it then. And everybody can do that without that much of a nightmare. So again, I want to right-size the fear. Right. For me, I'm wondering, was there anything that we all could have done to prevent this? Or is that really just not possible?

Absolutely not. Yeah, there is nothing that we could have done. There's nothing you can do sitting there today to get yourself out of the national public database. And that is a problem. And so the one thing that you can do is call your member of Congress and say, there's several different variations of a nationwide privacy law that has been kicked around for 20 years, for 20 years. The last time we had a privacy law, the records, it was essentially about keeping VHS video record rentals private. Congress has not protected us and And a national privacy law would give us a lot of additional rights. And the U.S. is way, way behind on the global stage in terms of

protecting our consumers from these kinds of things. So while we're waiting for Congress to actually do anything, is there anything law enforcement could have done? I wish there were. Not that I know of. You know, when something bad happens to you, you should file a police report. And those police reports get filtered up to state law enforcement offices. And you might catch a criminal gang here and there because a thousand people file a report. So it is, even though it's tedious, it is important to file a report when something bad happens. You know, as far as, you know, the idea that the FBI might be in the underground fighting this battle against these criminal gangs. And they do.

But they certainly, that's a game of whack-a-mole. They certainly can't stop them all. It's hard not to feel helpless in a situation like this. As you said, there's really nothing we can do to prevent it. What's your advice when it comes to recovery? I think that helplessness feeling is very authentic and very real. And we all have that sense of the ground moving under our feet. But the one thing that I don't want people to feel like is that famous expression, you have no privacy anyway, get over it. I want you to still be mad about this. The idea that there's nothing you can do, so just throw your hands up, that would make you sort of passive about it. I do think you should be interested in what the state houses are passing

privacy laws as well. So you can get involved in local politics and get interested that way. But I think the most important thing is monitoring yourself. Get into a habit. It only takes a few seconds when you're registered online with your bank. You can check once a day for 10 seconds, make sure nothing looks weird. All of us, I'm sure at this point, have gotten multiple offers of free credit monitoring

because of some other data breach in the past. You get those letters. Go ahead and sign up for that. That's worth it. They'll send you an email once a month or so and tell you that something or nothing has happened to your credit that. That's worth it. They'll send you an email once a month or so and tell you that something or nothing has happened to your credit report. That's worth doing and be vigilant yourself. And if something bad happens, there's a free service at the Identity Theft Resource Center. They have an 800 number. They

have an online chat. There's people who will help you for free to get back on your feet. So it's not the disaster that it might feel like it's going to be. Okay, Bob Sullivan, thanks so much for helping us out today. Sure, anytime. Up next, a few money headlines from the last few days. Anna, since we rarely go an episode without talking about the Fed, let's not break the streak now. Yeah, big annual central bank summit in Jackson Hole, Wyoming last week, where Fed Chair Jerome Powell said, quote, the time has come for policy to adjust,

meaning interest rate policy. This was a bat signal for the markets and economists everywhere who have been waiting on word of a rate cut for months. All signs point to September as the moment that will happen, likely with a quarter percentage point cut in the key federal funds rate. But who knows, a half percentage point cut is also possible. Powell cited a cooling labor market as a reason for the turnabout from two years of fighting inflation. The next meeting of the Federal Reserve Open Market Committee is September 17th to 18th, so we'll all be on tenterhooks till then. Anna, you know who's ultra ready for interest rates to start going down? Home buyers and sellers.

Indeed. The housing market has been stuck in a low energy cycle for the last couple of years because buyers didn't want to pay high interest rates on mortgages, so sellers didn't have much of a market to sell into. Plus, sellers also didn't want to get rid of their own low interest rate mortgages. And of course, there's also the fact that houses have become more and more expensive and unaffordable for many Americans. The National Association of Realtors reported that the median price of existing homes rose 4.2% in July over the same time last year to $422,600. That's not deterring all homebuyers, though.

Sales of previously owned homes rose 1.3% in July from the month before, partly because mortgage rates have already dropped to their lowest level in 15 months. There are significant changes coming to the way people work with real estate agents that could also affect how the housing market performs. Next week, we'll review those changes with housing nerd Holden Lewis. In the meantime, if you're wondering how much house you can afford in today's market, then I'd suggest you play with NerdWallet's How Much House Can I Afford calculator. It's a handy tool that can help you figure out if now is the right time for you to make a housing move. You can find a link to that in today's show notes or just search for NerdWallet How Much House Calculator. And one more bit of housing news, Sean, this time for renters. The rent is too damn high.

It certainly is for a lot of folks whose rent skyrocketed in recent years. The Justice Department has filed an antitrust lawsuit against a company called RealPage. RealPage makes software that landlords use for everything from setting rental prices and screening applicants to managing buildings. The suit alleges that the company's algorithm allowed landlords to conspire to push up rents and keep rents high. The practice is known as price fixing, and it's illegal. The company has a widespread footprint in the U.S. rental market. Its software

is used by property owners covering some 3 million rental units. Eight states joined the suit. The company denies the allegations and says its software was, quote, purposely built to be legally compliant. But U.S. Attorney General Merrick Garland said the company had found a new way to scheme with landlords to break the law. And that's it for this week's money news. We always welcome your money questions and comments. Turn to the nerds and call or text us your questions at 901-730-6373. That's 901-730-NERD. Or send us a voice memo at podcast at nerdwallet.com. And remember, you can follow the show on your favorite podcast app, including Spotify, Apple Podcasts, and iHeartRadio to automatically download new episodes. Today's episode was produced by Tess Vigeland and

edited by Rick Vanderkneife. Here's our brief disclaimer. We are not financial or investment advisors. This nerdy info is provided for general educational and entertainment purposes and may not apply to your specific circumstances. And with that said, until next time, turn to the nerds.