InfoSecBulletin Cybersecurity for mankind
Researchers from Duke University conducted a data brokerage project. They reached out to 12 data brokers and purchased information from three of them. The brokers were selling various types of data, including health, financial, contact information, family member details, net worth, and religion. It’s important to note that none of this data was deanonymized.
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Researchers purchased data on approximately 5,000 active-duty military personnel from a single broker. The data included various information such as their name, home and email addresses, political affiliation, gender, age, income, net worth, credit rating, presence of children in their home, marital status, home value, and religion. The cost per military servicemember was only $0.213.
Data brokers selling military staff data could be a national security threat, says Justin Sherman from Duke’s Sanford School of Public Policy. Sherman explains that data brokers collect information on almost all Americans, including high-ranking members of the military and other national security agencies. This raises concerns about the potential risks to national security.
Foreign actors benefit from the lack of privacy regulations in the US. Companies are already collecting and organizing personal data, including sensitive and private information. This data could be used for bribery and blackmail, as stated by Sherman.
ALSO READ:
Researchers at Duke University found that buying data was not only affordable, but it was also simple due to the lack of background checks or authentication. The researchers demonstrated that brokers were willing to send potentially sensitive data on defense employees to foreign entities by using a .asia email address and servers based in Singapore.
The brokers gather information from many different sources. When asked, the companies did not disclose where they obtained the data. Some said it came from mobile apps and medical records, while others claimed to have received it from nonprofits.
While the data trade is, for the most part, entirely legal, Sherman believes the laws around the industry need strengthening. “Some think of data brokers as only third-party companies, but it’s important to understand just how many first-party collectors of data, such as mobile apps on our phones, may turn around and sell data about us to data brokers,” Sherman added.
Aden Klein, a senior at Duke and co-author of the report, stated that data brokers have weak controls. These controls are more concerned with getting paid and protecting themselves from liability rather than preventing the sale of data on servicemembers or others.
According to the report, there were some protections in place regarding the sale of geolocation information. One broker mentioned that they would not sell this data to individuals near “sensitive” locations, but were willing to sell it for individuals anywhere else in the U.S.
