“KrebsOnSecurity has learned that another NPD data broker which shares access to the same consumer records inadvertently published the passwords to its back-end database in a file that was freely available from its homepage until today.”
National Public Data leaked names, addresses and phone numbers for more than 272 million people. Its sister site recordscheck.net left a file called members.zip on its homepage with plain text admin credentials. Users all got the same six-character starting password, and the passwords match ones from earlier breaches of the founder’s own email accounts. Nobody asked these people to collect your Social Security number, and nobody stopped them from guarding it like this.