Gravy Analytics Breach Exposes Millions of Users' Location Data
Hackers claim to have stolen precise location data for millions of smartphone users from data broker Gravy Analytics, exposing the risks of location tracking.
Hackers have claimed to breach Gravy Analytics, a major location data broker, potentially exposing precise location data for millions of smartphone users. The breach highlights the privacy risks inherent in the location data industry.
What Was Exposed
According to reports, the breach includes:
- Precise location data: GPS coordinates from millions of mobile devices
- Historical movement patterns: Location histories showing where users have been
- App associations: Which apps collected and shared the location data
- Timestamps: When users were at specific locations
How Location Data Is Collected
Gravy Analytics aggregates location data from numerous sources:
- Mobile apps with location permissions (weather, games, utilities)
- Advertising SDKs embedded in apps
- Data brokers and aggregators
- Real-time bidding systems
Users often grant location permissions without understanding that their data may be sold to data brokers.
Privacy Implications
Precise location data can reveal sensitive information:
- Home and work addresses
- Medical facility visits
- Religious worship locations
- Political rally attendance
- Personal relationship patterns
Regulatory Context
The breach comes amid increased regulatory scrutiny of location data brokers. The FTC has taken action against several companies for selling sensitive location data, and states are passing laws restricting location data collection.
Protecting Your Location Data
Users can reduce location tracking by:
- Reviewing and revoking app location permissions
- Using "While Using" instead of "Always" for necessary apps
- Disabling advertising identifiers
- Using privacy-focused browsers and apps
Related Articles
Cloudflare 2026 Threat Report: 230 Billion Daily Blocked Threats and the Rise of Credential Attacks
Cloudflare has published its inaugural annual threat report revealing the company blocks over 230 billion threats daily across 20% of global web traffic. DDoS attacks doubled year-over-year to 47.1 million incidents, with the largest reaching a record 31.4 Tbps, while bots now account for 94% of all login attempts.
HashiCorp Patches Consul Arbitrary File Read Vulnerability in Kubernetes Auth
HashiCorp has released emergency patches for Consul to address CVE-2026-2808, a medium-severity vulnerability allowing arbitrary file reads when Kubernetes authentication is enabled. The fix also adds HTTP server timeouts to prevent Slowloris denial-of-service attacks against Consul agent endpoints.
Let's Encrypt Now Issues Six-Day Certificates and IP Address Certificates via Certbot
Let's Encrypt and the EFF have announced support for six-day (160-hour) certificates and IP address certificates through Certbot 5.3 and 5.4. The ultra-short-lived certificates reduce the impact window of compromised keys by design, while IP address certificates enable HTTPS for services identified by address rather than hostname.