Episode
21 July 2026 Official episode · Official transcript
advanced persistent threat black hat cybercrime dark web
The episode examines identity theft, USDoD’s intrusions and data sales, the National Public Data breach, data-broker practices, and privacy protections.
Topics: Identity theft and identity proofing, Data-broker collection and sale of personal information, National Public Data breach, API authorization failure, Exposed source code and administrative credentials, Password reuse, Social engineering, Data scraping, Dark-web data dumps, Impersonation-based intrusion, SIM swapping, Doxxing and OSINT correlation, End-to-end encryption, Privacy-focused browsers, Data-broker regulation and opt-out mechanisms
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Matthew Kierans USES identity theft
Matthew stole William Woods's wallet and documents, copied his identity information, and used William's identity for decades.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“Matthew had started calling himself William Woods.”
“Matthew had been using William’s identity for thirty-one years”
Matthew Kierans MEMBER_OF University of Iowa
Matthew obtained a $100,000-a-year IT job at the University of Iowa while using William Woods's identity.
Explicit Confidence 98% · Jack Rhysider EP 177 Details
“Now he got a $100,000-a-year IT job at the University of Iowa”
Luan Barbosa SAME_AS USDoD
Jack identifies the hacker known as USDoD as Luan Barbosa.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“his name was Luan Barbosa”
“USDoD, or Luan”
USDoD is described as a hacker from Brazil and as living in Brazil in the account attributed to him.
Explicit Confidence 98% · Jack Rhysider EP 177 Details
“this hacker from Brazil”
“the hacker known as USDoD was living in Brazil”
USDoD USES social engineering
USDoD tried to gain access to the PEO network by impersonating and socially engineering one of its developers.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“He tried getting access through the developer using social engineering techniques”
USDoD USES PEO exploit
USDoD accepted a job to help collect military data and worked with Russian hackers in an operation involving an exploit for PEO.
Explicit Confidence 90% · Jack Rhysider EP 177 Details
“USDoD accepted the job”
“USDoD discovered that a way into this network”
PEO exploit EXPLOITS Unknown PEO vulnerability
The exploit was built for an unknown vulnerability in the Program Executive Office Enterprise Information System.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“were able to build an exploit for an unknown vulnerability in the US army IT platform called the Program Executive Office Enterprise Information System”
PEO exploit AFFECTS Program Executive Office Enterprise Information System
The PEO exploit affected the US Army's Program Executive Office Enterprise Information System.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“an exploit for an unknown vulnerability in the US army IT platform called the Program Executive Office Enterprise Information System”
USDoD TARGETS Department of Defense
USDoD breached the Department of Defense and published military emails and passwords.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“That is how he got the hacker name USDoD, by breaching the Department of Defense”
USDoD targeted InfraGard, the FBI-linked system for reporting incidents.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“His next target was InfraGard.”
“that was the site that USDoD was trying to attack”
USDoD USES data scraping
USDoD used a Python script to retrieve InfraGard members' contact information through the site's API.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“USDoD asked a friend to write him a Python script to grab the data”
“he used it to steal every InfraGard member’s contact information”
USDoD or Luan is described as having broken into a cybersecurity defense center at NATO.
Explicit Confidence 98% · Jack Rhysider EP 177 Details
“Luan, broke into Cybersecurity Defense Center at NATO”
USDoD or Luan is described as having breached Airbus and its vendors.
Explicit Confidence 98% · Jack Rhysider EP 177 Details
“the aerospace company Airbus and their 3,000 vendors”
Clearview AI USES data scraping
Clearview AI is described as scraping photographs and information from major social media websites.
Explicit Confidence 98% · Jack Rhysider EP 177 Details
“They were raiding major social media websites. They’d take Facebook, for example, grab every picture and bit of information they could”
Records Check DEVELOPED_BY Salvatore Verini Jr.
Sal created Records Check as one of three nearly identical data-broker websites.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“He created three almost identical websites; Records Check, Criminal Screen, and the flagship site, National Public Data.”
Criminal Screen DEVELOPED_BY Salvatore Verini Jr.
Sal created Criminal Screen as one of his three data-broker websites.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“He created three almost identical websites; Records Check, Criminal Screen, and the flagship site, National Public Data.”
National Public Data DEVELOPED_BY Salvatore Verini Jr.
Sal created National Public Data as the flagship site of his data-broker business.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“the flagship site, National Public Data”
National Public Data USES data scraping
National Public Data collected personal information by scraping or acquiring data from brokers, marketing lists, social media, and apps.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“Sal either bought or scraped data from other data brokers, subscription and marketing lists, loyalty and rewards programs, social media, and other apps.”
National Public Data breach COMPROMISES National Public Data
The National Public Data breach compromised the data held by National Public Data.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“National Public Data leaked full names, birthdays, social security numbers, home addresses, past addresses, e-mail addresses, and phone numbers all in plain text.”
National Public Data breach ATTRIBUTED_TO USDoD
The breach is attributed in the episode to Luan, operating as USDoD, who took the National Public Data records and posted them for sale.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“Luan took everything, 2.9 billion lines of data, 277 gigabytes worth”
“he posts it for sale online as USDoD”
USDoD COMPROMISES National Public Data
USDoD gained access to National Public Data after reusing credentials that first enabled access to Records Check.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“Sal reused passwords, which allowed Luan to log in to National Public Data”
USDoD USES credential reuse
USDoD exploited Sal's reused passwords to move from Records Check into National Public Data.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“Sal reused passwords, which allowed Luan to log in to National Public Data”
National Public Data CONTAINS members.zip
The breach narrative identifies members.zip as a publicly accessible file containing site source code and embedded administrator credentials; the file was found on the connected Records Check site.
Explicit Direction flagged Confidence 88% · Jack Rhysider EP 177 Details
“one file stood out, members.zip”
“Members.zip had Sal’s site’s source code, and buried inside the code were admin credentials.”
Salvatore Verini Jr. ASSOCIATED_WITH Perfect Privacy LLC
Jack says Sal supposedly sold his data-broker company to Perfect Privacy LLC; the account is explicitly hedged.
Uncertain Confidence 84% · Jack Rhysider EP 177 Details
“Sal supposedly sold his data broker company to another company which is ironically called Perfect Privacy LLC.”
Luan Barbosa DISCOVERED_BY CrowdStrike
CrowdStrike investigated USDoD and determined Luan's name, address, phone number, tax registration ID, and other details from his reused email address.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 177 Details
“CrowdStrike was able to figure out his name, address, phone number, tax registration ID, and more.”
Luan Barbosa USES Doxxing
Luan was doxxed after CrowdStrike and others identified and exposed his personal details, although Jack characterizes the doxxing as initially private.
Explicit Confidence 96% · Jack Rhysider EP 177 Details
“Basically, Luan got doxxed, but privately”
National Public Data breach INVOLVES data scraping
The episode describes the breach as involving a scraping company whose purpose was to find and aggregate information about people.
Attributed Confidence 96% · Speaker3 EP 177 Details
“The problem with the NPD data breach is that it is a scraping company that was designed to find out everything it can about you.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T09:04:30.179034+00:00