177- National Public Data

Homeless Man Lost Identity For Decades
- William Woods’ wallet was stolen in 1988 and the thief, Matthew Kearins, used his birth certificate and SSN to assume Woods’ identity for decades.
- Kearins obtained official documents, a driver’s license with his photo, jobs, marriage, and loans under Woods’ name. (Time 0:01:00)
Victim Arrested While Thief Lived Freely
- When the real William confronted a bank, the impersonator (Matthew) answered security questions and sent identity documents, convincing cops the phone claimant was the true account owner.
- William was wrongly institutionalized, jailed, billed $118,000, then later exonerated by DNA. (Time 0:04:27)
Heartbreak Fueled An APT’s Vendetta
- USDOD (Luan Barbosa) claims a personal vendetta against the U.S. after a failed relationship and alleged hospital-hacking episode in 2012.
- He joined dark web communities, trained with international actors, and escalated to major targets over years. (Time 0:13:36)
Small Teams Can Expose Major Military Systems
- USDOD collaborated with Russian actors to exploit an unknown vulnerability in the Army’s PEO platform and exfiltrated source code and databases from military-related organizations.
- He published military emails and passwords, earning notoriety and triggering U.S. investigations. (Time 0:18:21)
Faked InfraGard Membership Exposed 80,000 Contacts
- USDOD applied to InfraGard using a stolen CEO identity, gained membership, then discovered an API that returned every member’s contact details.
- He scripted an automated dump and stole 80,000 executives’ contact records for sale. (Time 0:20:46)
Deputy Turned Data Broker Built Fragile Empire
- Salvatore Verrini Jr. (Sal) left a sheriff’s office to launch National Public Data and similar sites, scraping and buying vast amounts of public and private records.
- He packaged hundreds of millions of profiles for law-enforcement and private customers while spending almost nothing on security. (Time 0:26:50)
One Exposed File Led To 2.9 Billion Records Stolen
- Luan found a publicly accessible members.zip on Records Check containing source code and admin credentials, then reused those credentials to access National Public Data.
- He exfiltrated 2.9 billion records and offered them for sale at $3.5 million. (Time 0:36:36)
Data Broker Breach Multiplies Identity-attack Power
- National Public Data’s leak included full names, birthdays, SSNs, addresses, emails, and phone numbers in plaintext, enabling deep identity profiles usable for fraud.
- Jack ties such breaches to real harms like loans, stolen credit, and lifelong financial damage. (Time 0:40:01)
Private Cybersecurity Firm Doxed The Hacker
- CrowdStrike traced USDOD through a reused email address and linked online accounts to Luan Barbosa, revealing his identity, location, and registration details.
- Brazilian police arrested Luan after the dox, and Sal faced lawsuits and failed bankruptcy attempts. (Time 0:44:24)
Breach Sparked Privacy Bill That Lobbying Killed
- Congress briefly moved toward a national opt-out privacy law after the breach, proposing the American Privacy Rights Act with a single-form data-broker deletion rule.
- Lobbying weakened the bill the day before the vote and it ultimately died. (Time 0:46:52)
Use Encrypted Messaging Email And A Privacy Browser
- Stop using unprotected text messages and prefer end-to-end encrypted tools like Signal for chats and Proton/Tuta for email.
- Use a privacy-focused browser (Jack recommends Brave) to reduce data leakage from address-bar telemetry. (Time 0:48:31)