Data Broker Hack Puts Millions at Risk of Location Exposure
A recent data breach involving Gravy Analytics, a prominent location data broker, has potentially exposed precise location data for millions of users globally. This breach is suspected to involve data from widely-used mobile applications, including popular games and apps related to dating and health tracking. The revelation was first covered by TechCrunch and followed up by further reports from media outlets in the tech industry.
Widespread Exposure of Sensitive Locations
According to Baptiste Robert, CEO of Predicta Lab, a digital security firm, a small sample of the data set was shared on a Russian forum, revealing data points for numerous globally significant locations. These included high-security areas such as the White House, Kremlin, and the Vatican. The exposed sample alone accounted for over 30 million precise locations.
Investigations and Security Measures
In its communication with the Norwegian Data Protection Authority, Gravy Analytics disclosed unauthorized access to its AWS cloud storage detected on January 4th. The company is still conducting an investigation to ascertain the duration of the unauthorized access and whether it qualifies as a reportable personal data breach. “Gravy Analytics is working diligently to determine the scope of the incident and the nature of the information involved,” the company stated, indicating that if personal data is implicated, it most likely pertains to users from third-party services.
"Gravy Analytics is working diligently to determine the scope of the incident and the nature of the information involved." – Gravy Analytics
Regulatory Scrutiny and Previous Sanctions
Prior to this incident, Gravy Analytics had faced legal scrutiny as one of two data brokers subjected to a proposed order by the Federal Trade Commission (FTC). The order would prevent them from dealing with sensitive location data in their products or services. The FTC had previously criticized Gravy Analytics’ subsidiary, Venntel, for aggregating data from various apps and marketing it to both commercial enterprises and government entities such as the IRS and the FBI.