National Public Data (NPD), a company that resells collected personal data for background checks, has confirmed that a data breach leaked names, Social Security numbers, physical addresses, and more. As reported by Bleeping Computer, dark web forum posters have advertised and shared supposedly stolen data from a breach of the company’s systems for months without a statement or response from NPD.

Finally, this week, it published a Security Incident page confirming a few details but leaving many other questions unanswered.

The massive leak reportedly included 2.9 billion rows of data for a still-unknown number of people, and analysis of files posted to hacking forums by Have I Been Pwned operator Troy Hunt showed inconsistencies in how the data is linked to specific people.

NPD says it “cooperated with law enforcement and governmental investigators and conducted a review of the potentially affected records and will try to notify you if there are further significant developments applicable to you.”

Its website does not report how many people have been affected, offer any compensation to the people whose information has been linked, or provide any avenues of direct contact for more information. It warns people to keep an eye on their credit reports, but that’s just about it.