The other way works better since National Public Data is based in Florida and because of the name of the company. If it said “International” instead of “National” the readers would assume it is international data.
Based on the location, name of the company, and the breach mentioning social security numbers, stating the US first is the most logical.