InfoSecBulletin Cybersecurity for mankind
Researchers from Duke University conducted a data brokerage project. They reached out to 12 data brokers and purchased information from three of them. The brokers were selling various types of data, including health, financial, contact information, family member details, net worth, and religion. It’s important to note that none of this data was deanonymized.
Researcher Found Multiple Vulnerabilities In Apple’s AirPlay Protocol
Massive Attack: Hacker Actively Use 4800+ IPs To Attack Git Configuration Files
CISA Adds Actively Exploited Broadcom Flaws to KEV Database
Google reports 97 zero-days exploited in 2024, 50% in spyware attacks
Palo Alto Networks to Acquire AI Security Firm “Protect AI”
CISA Releases Seven ICS Advisories
India Launches First Quantum Computing Village in Amaravati
400+ SAP NetWeaver Devices Vulnerable to 0-Day Attacks
30 Teams Qualify for Online Preliminary Round At UAP CTF Contest
CVE-2025-43859
Request Smuggling Vulnerability in Python’s h11 HTTP Library
Researchers purchased data on approximately 5,000 active-duty military personnel from a single broker. The data included various information such as their name, home and email addresses, political affiliation, gender, age, income, net worth, credit rating, presence of children in their home, marital status, home value, and religion. The cost per military servicemember was only $0.213.
Data brokers selling military staff data could be a national security threat, says Justin Sherman from Duke’s Sanford School of Public Policy. Sherman explains that data brokers collect information on almost all Americans, including high-ranking members of the military and other national security agencies. This raises concerns about the potential risks to national security.
Foreign actors benefit from the lack of privacy regulations in the US. Companies are already collecting and organizing personal data, including sensitive and private information. This data could be used for bribery and blackmail, as stated by Sherman.
ALSO READ:
Researchers at Duke University found that buying data was not only affordable, but it was also simple due to the lack of background checks or authentication. The researchers demonstrated that brokers were willing to send potentially sensitive data on defense employees to foreign entities by using a .asia email address and servers based in Singapore.
The brokers gather information from many different sources. When asked, the companies did not disclose where they obtained the data. Some said it came from mobile apps and medical records, while others claimed to have received it from nonprofits.
While the data trade is, for the most part, entirely legal, Sherman believes the laws around the industry need strengthening. “Some think of data brokers as only third-party companies, but it’s important to understand just how many first-party collectors of data, such as mobile apps on our phones, may turn around and sell data about us to data brokers,” Sherman added.
Aden Klein, a senior at Duke and co-author of the report, stated that data brokers have weak controls. These controls are more concerned with getting paid and protecting themselves from liability rather than preventing the sale of data on servicemembers or others.
According to the report, there were some protections in place regarding the sale of geolocation information. One broker mentioned that they would not sell this data to individuals near “sensitive” locations, but were willing to sell it for individuals anywhere else in the U.S.
