InfoSecBulletin Cybersecurity for mankind
Researchers from Duke University conducted a data brokerage project. They reached out to 12 data brokers and purchased information from three of them. The brokers were selling various types of data, including health, financial, contact information, family member details, net worth, and religion. It’s important to note that none of this data was deanonymized.
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
Researchers purchased data on approximately 5,000 active-duty military personnel from a single broker. The data included various information such as their name, home and email addresses, political affiliation, gender, age, income, net worth, credit rating, presence of children in their home, marital status, home value, and religion. The cost per military servicemember was only $0.213.
Data brokers selling military staff data could be a national security threat, says Justin Sherman from Duke’s Sanford School of Public Policy. Sherman explains that data brokers collect information on almost all Americans, including high-ranking members of the military and other national security agencies. This raises concerns about the potential risks to national security.
Foreign actors benefit from the lack of privacy regulations in the US. Companies are already collecting and organizing personal data, including sensitive and private information. This data could be used for bribery and blackmail, as stated by Sherman.
ALSO READ:
Researchers at Duke University found that buying data was not only affordable, but it was also simple due to the lack of background checks or authentication. The researchers demonstrated that brokers were willing to send potentially sensitive data on defense employees to foreign entities by using a .asia email address and servers based in Singapore.
The brokers gather information from many different sources. When asked, the companies did not disclose where they obtained the data. Some said it came from mobile apps and medical records, while others claimed to have received it from nonprofits.
While the data trade is, for the most part, entirely legal, Sherman believes the laws around the industry need strengthening. “Some think of data brokers as only third-party companies, but it’s important to understand just how many first-party collectors of data, such as mobile apps on our phones, may turn around and sell data about us to data brokers,” Sherman added.
Aden Klein, a senior at Duke and co-author of the report, stated that data brokers have weak controls. These controls are more concerned with getting paid and protecting themselves from liability rather than preventing the sale of data on servicemembers or others.
According to the report, there were some protections in place regarding the sale of geolocation information. One broker mentioned that they would not sell this data to individuals near “sensitive” locations, but were willing to sell it for individuals anywhere else in the U.S.
