{"id":46434,"date":"2025-01-14T14:55:08","date_gmt":"2025-01-14T19:55:08","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=46434"},"modified":"2025-01-14T14:55:51","modified_gmt":"2025-01-14T19:55:51","slug":"gravy-analytics-hacked","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2025\/01\/14\/gravy-analytics-hacked\/","title":{"rendered":"Gravy Analytics Hacked"},"content":{"rendered":"

Joseph Cox<\/a>:<\/p>\n

\n

Hackers claim to have compromised Gravy Analytics, the parent company of Venntel which has sold masses of smartphone location data to the U.S. government. The hackers said they have stolen a massive amount of data, including customer lists, information on the broader industry, and even location data harvested from smartphones which show peoples’ precise movements, and they are threatening to publish the data publicly.<\/p>\n

[…]<\/p>\n

The thousands of apps, included in hacked files<\/a> from location data company Gravy Analytics, include everything from games like Candy Crush to dating apps like Tinder, to pregnancy tracking and religious prayer apps across both Android and iOS. Because much of the collection is occurring through the advertising ecosystem —not code developed by the app creators themselves— this data collection is likely happening both without users’ and even app developers’ knowledge.<\/p>\n<\/blockquote>\n\n

Nick Heer<\/a>:<\/p>\n

\n

You remember Gravy Analytics, right? It is the one from the stories<\/a> and the FTC settlements<\/a>, though it should not be confused with all the other ones<\/a>.<\/p>\n<\/blockquote>\n\n

Juli Clover<\/a>:<\/p>\n

\n

Gravy Analytics’ parent company Unacast disclosed the data breach earlier this month [PDF<\/a>], and said that its AWS cloud storage environment had been accessed by an unauthorized person using a “misappropriated access key.”<\/p>\n

[…]<\/p>\n

The order required Gravy Analytics to delete all historic location data and any data products developed using data collected from consumers, but it was apparently too late because the company’s systems had likely already been breached at the time.<\/p>\n

Gravy Analytics collects location data through a real-time ad bidding process that allows companies competing to buy an ad to see customer IP address and more precise location data if enabled.<\/p>\n

[…]<\/p>\n

Baptiste Robert, CEO of security firm Predicta Lab, told TechCrunch that iPhone users that had app tracking disabled did not have their data shared.<\/p>\n<\/blockquote>\n\n

See also: Bruce Schneier<\/a>:<\/p>\n\n

Previously:<\/p>\n