Last month, the FTC charged a company with unlawfully selling your personal information.
When discussing data privacy, companies such as Google and Facebook frequently come under fire for leveraging personal information to deliver targeted advertisements and suggestions. However, there is less attention given to those businesses whose core operations hinge on gathering user data and selling it to various corporations and governmental entities. These organizations often navigate legal ambiguities, with the consent needed for data collection often hidden away in lengthy terms and conditions.
What’s even more concerning is that these data brokers fail to adequately protect the data they collect. Last year, National Public Data made headlines for failing to secure 2.7 billion records of individuals whose data it had harvested. Now, hackers have reportedly stolen data from Gravy Analytics, the parent company of Venntel, which has sold vast amounts of smartphone location data to the U.S. government.
Enter the giveaway by signing up for my free newsletter.
View pictures in App save up to 80% data.
Essential Information Regarding the Breach
Hackers claim to have breached Gravy Analytics, a major location data broker and parent company of Venntel, a firm known for selling smartphone location data to U.S. government agencies. The compromise is massive, including sensitive location data that tracks precise smartphone movements, customer information and even internal infrastructure, according to a 404 Media report.
The cybercriminals are warning that they will release the compromised data to the public. The files include exact latitude and longitude coordinates of the phone, along with timestamps of when the phone was located. Some entries even specify the country from which the data was gathered.
Hackers have alleged that they have been infiltrating Gravy's systems since 2018. If these claims are accurate, it indicates a grave oversight in the company’s security measures. It is perplexing how organizations that gather and monetize user data (a practice that many believe should be prohibited altogether) have not managed to safeguard that information from exposure.
According to 404 Media, the hackers were able to penetrate deeply into the company’s infrastructure, obtaining access to Amazon S3 buckets and server root privileges. The leaked customer list is said to feature prominent firms such as Uber, Apple, and Equifax, along with government contractors like Babel Street.
View pictures in App save up to 80% data.
What the implications of this breach are for individuals
This data breach underscores the significant security vulnerabilities present within the location data sector. Firms such as Gravy Analytics and Venntel have been reaping financial rewards by gathering and trading sensitive location information, frequently without obtaining adequate user consent. Their focus on profit has overshadowed the importance of security, putting the privacy of millions in jeopardy. This information could potentially be trafficked on illicit markets, putting individuals, particularly those in precarious circumstances, at risk of harassment or even more severe consequences.
The FTC's recent action against Gravy, revealed in December, highlights their lack of oversight. The suggested order will bar these companies from selling or utilizing location data, with exceptions made only for situations involving national security or law enforcement. This raises significant concerns. Sensitive places such as schools and workplaces may become vulnerable to individuals with harmful intentions.
View pictures in App save up to 80% data.
5 Strategies to Protect Yourself in the Era of Data Breaches
The Gravy Analytics data breach highlights the significant risks we face in today’s digital landscape. Although we cannot dictate how every organization manages its data, there are proactive measures you can adopt to reduce your risk and safeguard your privacy. Below are five practical tips to help you stay secure.
1) Limit app permissions: Many apps request access to location data, contacts and more, even when it's not necessary for their functionality. Regularly review the permissions for apps on your smartphone and revoke access to anything that feels excessive. For instance, a weather app doesn’t need access to your microphone or camera.
2) Use a VPN: Virtual private networks (VPNs) can mask your IP address and encrypt your internet activity, making it harder for data brokers and hackers to track your online behavior. A good VPN adds an extra layer of security, especially when using public Wi-Fi networks. For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices.
3) Opt out of data sharing where possible: Some companies allow you to opt out of having your data collected or shared. Services like Your Ad Choices and privacy settings within platforms like Google can help you reduce the amount of data collected. Check for opt-out options with any apps or services you use frequently.
4) Avoid free apps that monetize data: Free apps often generate revenue by selling user data. Instead, consider paid versions of apps that explicitly prioritize privacy. Research the company behind the app to understand its data handling policies before downloading.
5) Invest in data removal services: Data removal services can help you regain some control over your personal information by identifying and removing it from people-search websites, data broker platforms and other online databases. Check out my top picks for data removal services here.
Kurt's main insight
Businesses that gather and monetize user information represent a serious risk to personal privacy. When these companies neglect to secure this data, it frequently falls into the hands of more malicious entities. Cybercriminals, along with certain government agencies, can utilize this information to target specific individuals. Therefore, it is essential to establish strict consequences for these organizations when they fail to uphold their responsibility to protect user data. A simple reprimand is insufficient; we require genuine accountability to discourage carelessness and uphold the privacy rights of individuals.
Should companies face stronger penalties for failing to protect personal data? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
