One of the largest companies that tracks Americans’ location through smartphone data, Gravy Analytics, has been hacked by Russian cybercriminals in exchange for ransom. According to two cybersecurity researchers and a Norwegian news outlet, the hackers claim to have accessed a massive trove of data, which was then posted online.
Gravy Analytics and its subsidiary, Venntel, have been accused of illegally collecting and selling Americans’ location data without their knowledge or proper legal consent. The company’s data is particularly valuable, as it can be used to extensively map a person’s life, often without their knowledge.
The company’s website has been down since Tuesday, and emails to the company, as well as its parent company, Unacast, have not been delivered. Executives at the company have not commented on the alleged breach.
The hackers, who claim to have accessed 17 terabytes of data, have threatened to release more information unless Gravy pays an unspecified ransom. The stolen data includes over 300,000 individuals’ email addresses, as well as location data on around 30 million individuals worldwide.
The breach highlights the risks associated with the location data industry, which is largely unregulated in the United States. Despite repeated calls for stronger privacy laws, there is currently no comprehensive federal privacy law in place. The lack of regulation has allowed companies like Gravy Analytics to operate largely unchecked, collecting and selling sensitive information about Americans’ daily lives.
The incident has sparked concerns about the vulnerability of the industry to cyber threats and the potential consequences for individuals whose data has been compromised. With the rise of location tracking and data brokers, the need for stronger privacy protections has become increasingly urgent.