Instant Checkmate, a people-search and background check service operated by PeopleConnect, suffered a data breach traced to a 2019 backup file. The data surfaced on a hacking forum in January 2023. PeopleConnect confirmed the exposed data was authentic and affected customer accounts created between 2011 and 2019. The breach stemmed from a misconfiguration or inadvertent exposure of the backup, with no evidence of a direct intrusion into active systems. Approximately 20.2 million records were compromised. The exposed data included full names, email addresses, phone numbers, and passwords stored as scrypt hashes. While scrypt is a hardened encryption format, cracking remains possible with sufficient resources, meaning passwords should be considered at risk. The breach carries heightened concern given the nature of the platform. Instant Checkmate aggregates detailed personal records on millions of individuals. A breach of its own customer database compounds that risk, exposing the identities and contact details of people who were researching others, in some cases for sensitive personal or professional reasons. PeopleConnect notified affected users and prompted password resets following discovery. No major regulatory enforcement action or settlement specific to this breach has been publicly documented. Affected individuals face real risks including phishing attacks, account takeover attempts on other services where the same password was reused, and potential targeting for stalking or doxxing. Anyone who held an Instant Checkmate account between 2011 and 2019 should treat their credentials as compromised and audit any accounts sharing the same password.

People-search and background-report services aggregate identity, address, phone, criminal-record, relative, and public-record data into searchable consumer profiles.

Instant Checkmate continues to operate under PeopleConnect alongside TruthFinder. The people search and data broker industry faces ongoing scrutiny under state privacy laws — particularly the California Consumer Privacy Act and similar legislation — requiring opt-out mechanisms and data deletion processes. No major organizational changes have been prominently reported beyond the regulatory environment context.