California’s privacy enforcement agency is pushing to penalize a Florida-based data broker involved in one of last year’s largest data breaches, which exposed hundreds of millions of Social Security numbers.
Regulator Seeks Financial Penalty
The California Privacy Protection Agency (CPPA), responsible for overseeing the state’s data privacy regulations under the California Consumer Privacy Act (CCPA), announced on Thursday that it is pursuing a $46,000 fine against National Public Data. The company is being penalized for failing to register as a data broker in California.
National Public Data made headlines in April 2024 when it suffered a cyberattack that led to the theft of its databases, exposing Social Security numbers and other personal details. The breach reportedly affected around 270 million people and compromised roughly three billion records, though some of the stolen data appeared to be inaccurate. It was one of the most significant data breaches of the year in terms of records exposed.
Legal and Bankruptcy Challenges
Following the breach, National Public Data filed for bankruptcy protection, claiming it lacked the financial resources to cover its debts. However, a Florida bankruptcy court rejected the company’s request in November 2024. This ruling left the company vulnerable to lawsuits and regulatory actions, including the CPPA’s enforcement efforts.
The agency initially filed a claim against National Public Data last year for failing to register as a data broker, a requirement for any company collecting and selling personal information in California. Despite regulations mandating registration by January 31, 2024, the company only complied on September 18, 2024—more than seven months late and only after being contacted by CPPA officials.
Broader Efforts Against Data Brokers
Data brokers, which collect and sell personal details such as location data, are subject to strict regulations in California. Companies that fail to register face penalties of up to $200 per day. The CPPA’s pursuit of National Public Data marks its sixth enforcement action against a data broker, with previous cases resulting in settlement agreements.
Lack of Response from Company Leadership
Salvatore Verini, the owner of Jerico Pictures, which operates National Public Data, has not responded to requests for comment regarding the fine or the company’s ongoing legal troubles.
