Hackers claim to have broken into a company that tracks and sells Americans’ location data

When it comes to data privacy, tech giants like Google and Facebook are often accused of using personal data to serve ads and recommendations. Less discussed are companies whose entire business model revolves around collecting your data and selling it to other companies and governments. These companies often operate in legal gray areas, with required consent to collect user data buried deep in the fine print.

What is even more worrying is that these data brokers fail to adequately protect the data they collect. Last year, National Public Data made headlines failed to secure 2.7 billion records of the individuals whose data it collected. Now hackers have reportedly stolen data from Gravy Analytics, Venntel’s parent company, which has sold massive amounts of smartphone location data to the US government.

I’M GIVING AWAY THE LATEST AND BEST AIRPODS PRO 2

Participate in the giveaway by logging in to my free newsletter.

What you need to know about the breach

Hackers claim to have breached Gravy Analytics, a major location data broker and parent company of Venntel, a company known for selling smartphone location data to US government agencies. The trade-off is huge, including sensitive location data that tracks a smartphone’s precise movements, user information and even internal infrastructure, according to 404 The media report.

Hackers threaten to publish the stolen data. The files contain the phone’s precise latitude and longitude coordinates and the time the phone was there. Some even state which country the data was collected from.

Hackers have gained access to Gravy’s systems since 2018. If this is true, it represents a serious security breach by the company. It’s baffling how companies that collect and sell user data (a practice that probably shouldn’t be allowed in the first place) have failed to protect the data from leaks.

404 Media also suggests that the hackers gained deep access to the company’s infrastructure, including Amazon S3 containers and server root access. The exposed list of buyers reportedly includes big companies like Uber, Apple and Equifax, as well as government contractors like Babel Street.

HERE’S WHAT RUTHLESS HACKERS STOLE FROM 110 MILLION AT&T USERS

What this breach means for people

This data breach highlights serious security flaws in the location data industry. Companies like Gravy Analytics and Venntel have profited from collecting and selling sensitive location data, often without proper user consent. They prioritized profit over safety, and now the privacy of millions is at risk. This data could end up on the black market, endangering individuals, especially those in vulnerable situations, making them targets for harassment or worse.

The FTC’s recent action against Gravy, announced in December, highlights their negligence. The proposed order would prohibit those companies from selling or using location data, except in special cases such as national security or law enforcement. The implications are troubling. Sensitive locations such as schools and workplaces could become easy targets for those with evil intentions.

BEWARE OF ENCRYPTED PDFS AS THE LATEST MALWARE DELIVERY TRICK

5 ways to stay safe in the age of a data breach

The Gravy Analytics breach serves as a sobering reminder of vulnerability in the digital age. While it’s impossible to control how each company handles data, you can take steps to reduce your exposure and protect your privacy. Here are five helpful safety tips.

1) Limit app permissions: Many applications require access to data about location, contacts and more, even when it is not necessary for their functionality. Regularly review app permissions on your smartphone and revoke access to anything that seems excessive. For example, a weather app doesn’t need access to your microphone or camera.

2) Use a VPN: Virtual private networks (VPNs) can mask your IP address and encrypt your internet activity, making it harder for data brokers and hackers to track your online behavior. A good VPN adds an extra layer of security, especially when using public Wi-Fi networks. For the best VPN software, check out my expert review of the best VPNs for private web browsing on your Windows, Mac, Android and iOS devices.

3) Turn off data sharing where possible: Some companies allow you to opt out of the collection or sharing of your information. Services like Your Ad Choices and privacy settings within platforms like Google can help you reduce the amount of data collected. Check the opt-out options for any apps or services you use frequently.

4) Avoid free apps that monetize data: Free applications they often generate revenue by selling user data. Instead, consider paid versions of apps that specifically prioritize privacy. Research the company behind the app to understand its data handling policies before downloading.

5) Invest in data removal services: Data removal services can help you regain control of your personal data by identifying and removing it from people search websites, data brokerage platforms and other online databases. Check out my top picks for data removal services here.

WHAT TO DO IF YOUR BANK ACCOUNT HACKED

Kurt’s key to the outside

Companies that collect and sell user data pose a significant threat to privacy, and when they fail to protect that data, it often ends up in the hands of even worse actors. Cybercriminals and even some governments can use this information to target individuals. It is crucial to apply strict consequences for these companies when they fail to fulfill their duty to protect user data. Just a slap on the wrist is not enough. We need real accountability to prevent negligence and protect individual privacy rights.

Should companies face tougher penalties for failing to protect personal data? Let us know by writing to us at Cyberguy.com/Contact.

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report newsletter by going to Cyberguy.com/Newsletter.

Ask Kurt a question or tell us what stories you want us to cover.

Follow Kurt on his social channels:

Answers to the most frequently asked CyberGuy questions:

New from Kurt:

Copyright 2024 CyberGuy.com. All rights reserved.