Reported Iraq Citizen Data Breach: 5,930,957 Records With SSNs

HEROIC analysts logged a reported data breach under the name Iraq Citizen Data, with records dated January 1, 2019. The breach is claimed, not confirmed, and it lists 5,930,957 records containing first names, last names, birthdays and Social Security numbers. Scanning your email is the way to see whether your information may be involved.

What This Combination Could Enable

Names, birthdays and Social Security numbers form the core of an identity. Together they are what a fraudster needs to impersonate someone or to try opening credit in another person's name. The breach is only reported, but the data types it lists call for attention in any case.

The Four Items Listed

• First names, used to make a scam message sound personal.
• Last names, which complete a name that can be matched to other records.
• Birthdays, a detail banks and carriers can ask for when verifying someone.
• Social Security numbers, an identifier that is hard to change and is used to open credit in a person's name.

No passwords or email addresses are listed in this record.

Why Identity Data Is Different From a Password

A password can be reset after a leak. A Social Security number and a birthday stay with a person for life, so claims involving them are worth acting on even before they are confirmed. The risks are identity theft, fraudulent applications and convincing impersonation calls.

How a Database Breach Works

A database breach means records were taken from one service's own systems rather than from a user's device. The claim here is that such records exist, and HEROIC has not confirmed it. Treat it as reported information and take sensible precautions.

Is Your Information Part of the Claim?

To check, scan your email and see your information. Because the record reportedly includes Social Security numbers, freeze your credit where it is available and review your credit reports for activity you do not recognize. Be cautious with calls, texts and emails that use your name or birthday. The same applies to your personal and your work email address.