MC2 Data leak allegedly exposes millions: check if you’re affected and learn if you need to act

What is MC2 Data?

The initial report on the MC2 Data breach was published by Cybernews, which describes MC2 Data as a background check firm. According to the article, MC2 Data operates several people-search sites, including PrivateRecords.net, PrivateReports, PeopleSearcher, ThePeopleSearchers, and PeopleSearchUSA. These sites explicitly state that they are not consumer reporting agencies, meaning they are not authorized to provide background checks for employment or tenant screening purposes.

As of the publication date of this article (September 25), Cybernews did not provide a direct link to an official MC2 Data company website, making it unclear whether MC2 Data operates other divisions beyond the mentioned people-search platforms. We highlight this to ensure transparency for our readers.

What happened?

Potential exposure of  background data of one-third of Americans
According to Cybernews, a human error led to the exposure of 106 million records. It’s not explicitly clear if these 106 million records represent individual profiles, but if they do, this would mean that approximately one-third of the U.S. population’s background information could be at risk, as the headline suggests: “One-third of the US population’s background info is now public.”

The types of data reportedly exposed include information typically aggregated from public records, marketing, and transactional sources, and compiled into consumer profiles:

• Names, dates of birth, emails, phone numbers, home addresses, family connections, neighbors (often publicly accessible on these sites).
• Legal records, property records, employment history, and other public records that are generally paywalled.

Exposure of sensitive data of MC2 Data customers
Cybernews reports that 2,319,873 users, including individuals and organizations subscribed to MC2 Data’s services, were also affected by the leak. The exposed data likely includes sensitive customer information, such as IP addresses, encrypted passwords, and partial payment details.

It’s important to distinguish between the types of data involved in this incident: the background data of millions of Americans and the data of MC2 Data service customers. The implications of the exposure differ significantly between these groups.

Are you in danger due to the MC2 Data leak?

The level of risk depends on which group you fall into:

If you’re a customer of MC2 Data: You are at a higher risk since your account credentials, passwords, and partial payment information may have been exposed. It’s crucial to take immediate steps, such as changing passwords, enabling multi-factor authentication, and closely monitoring your financial accounts.

If you were never an MC2 Data customer: You might still be part of the one-third of the U.S. population whose background information has been made more accessible. Although much of this information is already available through people-search sites, it usually sits behind paywalls, making it costly and cumbersome to access. Now that this data is grouped in a large dataset with millions of records, it becomes an attractive tool for cybercriminals, enabling them to conduct widespread phishing campaigns, mass hacking attempts, and other malicious activities with minimal effort.

So, can you do anything to mitigate your risks caused by MC2 Data’s negligence?

To help protect yourself after the MC2 Data leak, here are some steps you can take:

1. Check your presence on MC2 Data sites: Run Onerep’s free scan to see if your information is listed on MC2 Data-operated sites. Then, use the service’s free trial to get access to the list of sites Onerep found you on. You can cancel the trial once you’ve checked your data’s presence. (Full disclosure: I am the CEO of Onerep, a company that offers this service.)

2. Remove your Information from public data broker sites: You can try removing yourself manually from numerous people-search sites step by step (use these free removal guides). However, this is easiest done with the help of privacy and data removal services like OneRep. [Use this link to get Onerep with a 50% discount.]

3. Choose services wisely: Always vet the platforms you use. Before creating an account, evaluate whether the company adheres to data security protocols. While even secure companies can experience data breaches, those that invest in robust cybersecurity measures are generally less vulnerable.