Alpharetta, Georgia-based ChoicePoint maintains personal profiles of nearly every US consumer, which it sells to employers, landlords, marketing companies and about 35 US government agencies.
In California, the only state that requires companies to disclose security breaches, ChoicePoint sent warning letters to 30,000 to 35,000 consumers advising them to check their credit reports.
Jones said the company was still determining whether consumers outside California were affected, and declined to say whether it would notify them.
US investigators notified the company of the breach in October, but ChoicePoint did not send out the consumer warnings until last week. Jones said it took a while for the company to determine which consumer records were affected.
The identity thieves set up roughly 50 fraudulent business accounts to gain access to consumer data, Jones said. The company has since tightened its criteria for access, he said.
The Los Angeles County Sheriff's Department has detained one suspect in the case who had access to at least six consumer files.
"We believe this is probably way more widespread than this one individual," Lieutenant Robert Costa said. A US Postal Service inspector said the agency could not talk about ongoing cases. The FBI did not return a call seeking comment.
ChoicePoint's databases contain 19 billion public records, including driving records, sex-offender lists and FBI lists of wanted criminals and suspected terrorists.
The company says its records enable law enforcers to track down serial killers and have helped find 822 missing children.