National Public Data Breach: What Mortgage Borrowers Should Do to Protect Their Credit

If you have not already taken steps to protect your credit file after the National Public Data breach, this article is for you — especially if you are planning to buy a home, refinance, or apply for any kind of mortgage financing in the next one to three years.

Why this matters now: The breach was confirmed in August 2024, but the stolen data continues to circulate actively in criminal markets. Identity theft and synthetic fraud cases tied to exposed SSN data have continued to surface throughout 2025 and 2026. The FTC maintains active consumer guidance on this breach at consumer.ftc.gov. If you have not yet placed a credit freeze or reviewed your credit reports, the window to act before a mortgage application is still open — but it closes the moment you are in escrow.

The National Public Data breach is one of the largest data exposures in history. The company, which aggregated personal information from public records and other sources, confirmed in August 2024 that attackers had obtained records containing Social Security numbers, names, addresses, dates of birth, and family relationship data. The company reported approximately 2.9 billion records were exposed — this figure refers to the number of data records in the database, not 2.9 billion unique individuals. Records can include duplicates and multiple historical entries for the same person. The actual number of unique individuals affected is not publicly confirmed. The data has been circulating in criminal markets since the breach.

What makes this breach different from a typical credit card compromise is that the exposed data is permanent. A stolen credit card number can be cancelled. A Social Security number cannot be changed. The information exposed in this breach will remain usable by identity thieves indefinitely.

For mortgage borrowers, that permanence matters.

Why This Breach Is Specifically Dangerous for Mortgage Applicants

Mortgage applications require a full credit pull from all three major bureaus — Equifax, Experian, and TransUnion. Lenders verify your Social Security number, employment history, income, and identity. The mortgage process is, by design, a comprehensive financial identity check.

That same process is exactly what identity thieves exploit.

With a Social Security number, date of birth, and address history — all of which were exposed in the National Public Data breach — a criminal can:

• Open new credit accounts in your name before you apply for a mortgage, increasing your reported debt and damaging your credit score
• File fraudulent tax returns using your SSN, which can create IRS complications that surface during mortgage underwriting
• Create a synthetic identity — combining your real SSN with a different name — to build a fraudulent credit file that may not show up in your own credit monitoring
• Attempt to take out loans or lines of credit using your identity, which appear on your credit report and can disqualify you from mortgage financing

None of these require the thief to have your current address or phone number. The Social Security number alone is the key.

What to Check Before You Apply for a Mortgage

If you are planning to buy a home or refinance within the next year or two, do these things now — before you are in the middle of a transaction.

Pull your credit reports from all three bureaus. You are entitled to free weekly reports at AnnualCreditReport.com (authorized by the FTC and the three bureaus). Review each report carefully for accounts you did not open, addresses you have not lived at, employers you have not worked for, and inquiries you did not authorize. Any of these can indicate that your identity has been used.

Place a credit freeze at all three bureaus. A credit freeze is free, it does not affect your existing credit, and it prevents anyone — including you — from opening new accounts in your name without first lifting the freeze. For a detailed explanation of how a credit freeze works during a mortgage application and how to manage the timing, see our earlier article on credit freezes and mortgage applications.

Check your Social Security earnings record. Visit ssa.gov and review your Social Security statement. If someone has been using your SSN for employment, fraudulent wages may appear on your record. This can also create complications during mortgage income verification.

Check the IRS for unexpected tax filings. If you have not already, create an account at IRS.gov and verify that no fraudulent returns have been filed using your SSN. A fraudulent prior-year return can create an IRS debt that surfaces during mortgage underwriting.

What Happens If Identity Theft Surfaces During a Mortgage Application

If a lender discovers accounts, inquiries, or discrepancies on your credit report that you cannot explain, your application will stall while the issues are investigated. In some cases, a lender may decline to proceed until the fraud is resolved.

Resolving identity theft during an active mortgage transaction is stressful and time-consuming. It typically requires filing an FTC identity theft report at IdentityTheft.gov, disputing fraudulent accounts with each bureau, and providing documentation to your lender. The process can take weeks.

The better path is to find and address any problems before you apply — not after you are in escrow with a closing date on the calendar.

If You Have Already Placed a Freeze

If you placed a credit freeze after the National Public Data breach was disclosed in 2024, verify that the freeze is still active at all three bureaus. Freezes do not expire, but they can be lifted and sometimes are not reinstated after a temporary lift. Confirm your freeze status directly at:

• Equifax: equifax.com/personal/credit-report-services
• Experian: experian.com/freeze/center.html
• TransUnion: transunion.com/credit-freeze

Also check ChexSystems (chexsystems.com) and NCTUE (the National Consumer Telecom and Utilities Exchange) if you want comprehensive protection, though these are less commonly checked in mortgage underwriting.

The Bottom Line for Mortgage Borrowers

The National Public Data breach did not expire. The data is still out there, still being used, and still relevant to anyone who applies for credit — including a mortgage. The steps above take less than an hour and can prevent weeks of delays or a derailed transaction.

If you have questions about how a credit issue might affect your mortgage qualification, contact us before you apply. Catching a problem early gives you time to fix it.

---

Sources: National Public Data breach confirmation (August 2024); FTC IdentityTheft.gov; AnnualCreditReport.com; Social Security Administration (ssa.gov); IRS Identity Theft Central (irs.gov/identity-theft-central). SMS Mortgage is a licensed mortgage broker in California and Colorado. Stephanie Pedley holds individual MLO authorizations in Texas and Ohio through sponsorship arrangements, and in Nevada through sponsorship with CASMIA HOLDING LLC (NMLS #1740673). NMLS Individual #1087365 · NMLS Company #1147207 · CA DRE #01265685. Equal Housing Opportunity. This article is for educational purposes only and does not constitute legal or financial advice. Contact a licensed mortgage professional for guidance specific to your situation.