25 ms·
Personal and social information of 1.2B people discovered in data leak
- 4ad 7y agoCan I do a GDPR request for the data about myself? How?
- Havoc 7y ago>Can I do a GDPR request for the data about myself? How? And send it where? It's unclear who owns this server
- 4ad 7y agoPeople Data Labs?
- vlz 7y agoFrom the article it seems that you can just create a free account and query your own name. > In order to test whether or not the data belonged to PDL, we created a free account on their website which provides users with 1,000 free people lookups
- Scoundreller 7y agoSeems like OxyData and PDL directly have more up-to-date records anyway. Could the server owner (Google) have to fulfill the request? Probably not, but interesting to think about.
- kerng 7y agoStart with Google, they will need to figure out and know who the actual owner is and who paid for the resources to host it.
- KaiserPro 7y agoGoogle are jointly liable for this service, so if you can't find a contact point, then you can email google with the service IP. They will more than happily point you on to the customer to avoid being taken to court.
- dudus 7y agoThey list 2 companies as owners of the data in the article. I guess there would be a good place. I'd love to do that but I'm not on the eu. But the article says that's possible the actual leak comes from a customer or former customer of these companies and the actual ownership is so far a mistery.
- rvrabec 7y agoIt's weird because for oxydata you have to contact their sales team... but peopledatalabs has an opt out form. https://www.peopledatalabs.com/opt-out-form https://www.peopledatalabs.com/opt-out-form People Data Labs privacy policy: 3. ACCESS TO AND CONTROL OVER INFORMATION A person may do any of the following at any time by contacting People Data Labs at support@peopledatalabs.com. People Data Labs will reply to a person’s request within five business days. A. Access any information we have on them, if any. B. Change, correct, or delete any information we have them, if any. C. Express any concerns about People Data Labs using their information. People Data Labs' team will act swiftly upon a person’s email request to change, correct, provide, delete, or explain anything a person query. People Data Labs understands if a person would like to opt out of People Data Labs' database. Opting out will stop all data sharing and enriching of all PII in People Data Labs servers for that person. Click here, if you would like to opt-out, or choose to have all data about you removed from People Data Labs' database. For https://www.oxydata.io/ https://www.oxydata.io/: Review and changes to your information Contact us at sales@oxydata.io to find out what information we have collected about you, and to request any changes to or deletion of it.
- Scoundreller 7y agoI want someone to start an opt-out service, where I send them $20, and they send a book of names by registered mail for opt-outs every month. An online opt-out system is too easy for them. I want each one to get a phone-book sized list of opt-outs every month. And the same for data requests. Someone that curates the data collectors, and sends them requests every month. Do you know which country’s “do not call” list I want to be on? All of them! Get my number on the AU list, the UK list, the DE list... Let’s crash the system.
- deusofnull 7y agoWould be a great idea and I bet it could be successful, but maybe at a lower price point and using lots of automation of opt-out forms. As far as opting out of many credit reporting agencies, check out https://www.consumer.ftc.gov/articles/0262-stopping-unsolicited-mail-phone-calls-and-email https://www.consumer.ftc.gov/articles/0262-stopping-unsolici... https://www.optoutprescreen.com/?rf=t https://www.optoutprescreen.com/?rf=t Also it seems like theres a service like this called Delete Me, but it also seems like theyre a manual opt-out shop. Would be cool if you could find a way to not have humans doing it. Bet they're just having people on amazon mechanical turk fill these out or something like that. https://joindeleteme.com/how-we-work/ https://joindeleteme.com/how-we-work/
- manigandham 7y agoThis is all scrapped public social media data. No credentials or govt information. It's very easy to download or buy this data legally.
- greyfox 7y agoare you sure? how did you come to that conclusion. thanks for the info though, very glad to hear it.
- dehrmann 7y agoLook at the personal record that was in the article. It looks like aggregated public information. And look at what the companies referenced in the DB do. It's possible there's someone selling them so not-quite-public info, too, but it's probably more like phone numbers and less like private messaged on Facebook or Linkedin. The title reads like data from 1.2B profiles was leaked by Facebook and Linkedin, but this looks like scraping public profiles from them.
- manigandham 7y agoYes, there are dozens of these data enrichment companies. They scrape public sites and use browser extensions, SaaS tools, inbox addons, etc. They mix it together into profiles, and pretty much have the same dataset by now. Clearbit is one of them and even a YC company.
- istorical 7y agoYep! And as someone who has worked with these data sets and worked on the scraping tools on services like LinkedIn, a lot of the data is outdated, incorrect, or mixing together different entities with the same name into one person or splitting the same person into separate entities incorrectly.
- cortesoft 7y agoI mean, this is literally just a leak of data that People Data Labs is selling to anyone who signs up to their service. The 'leak' is just bypassing their payment requirements, so by definition all the data leaked is available for purchase.
- kitotik 7y agoYet another Elasticsearch server wide open. This is going to make the flurry of open mongodb servers look trivial.
- toomuchtodo 7y agoThey're everywhere. Just ask Shodan.
- BrianHenryIE 7y ago> Shodan is a search engine that lets the user find specific types of computers connected to the internet using a variety of filters. Some have also described it as a search engine of service banners, which are metadata that the server sends back to the client. Interesting.
- deleted 7y ago[deleted]
- dclusin 7y agoI remember there was some brewhaha a while back about how Shodan was able to discover services on IPv6 since the address space was so sparse. Apparently they were running enough of their own NTP servers to reliably map out lots of devices on IPv6.
- DarthGhandi 7y agoNot being able to map ipv6 space is a myth. There's plenty of workarounds.
- dclusin 7y agoSuch as? Not too familiar with the subject, would love to know how.
- 7y ago
- imglorp 7y agoIn retrospect, it would have been interesting to have a bunch of accounts each containing a unique "map trap", at all of the larger services. Then years later, when the aggregator/broker guys get hacked/sold/leaked, you'd have some picture of the genealogy involved.
- 3fe9a03ccd14ca5 7y agoThe problem is that you often can’t find access to the actual “password” used in the breach. Does anyone know where I can see if it was an actual password or just some made up thing?
- cannonedhamster 7y agoThere was no password on the original ES instance it was open to the web.
- 3fe9a03ccd14ca5 7y agoI meant my password.
- 7y ago
- retSava 7y ago> In order to test whether or not the data belonged to PDL, we created a free account on their website which provides users with 1,000 free people lookups per month. Well that's very generous of them. Now I know what I'm gonna do next.
- greyfox 7y agodoes anyone know how we can search the data to find info about our (more than likely) entries in this database? or did they simply find it but not release the info?
- bovermyer 7y agoNot the aggregate data set, but one of the two data sources (People Data Labs) offers free access for under 1,000 searches per month.
- Havoc 7y agoOut of curiosity how do you guys think they managed to scrape LinkedIn on such a large scale? I've been wanting to do some social graph experimentation on it (small scale - say 1000 people near me) but concluded I probably couldn't scrape enough via raw scraping without freaking out their anti-scraping. (And API is a non-starter since that basically says everything is verboten).
- alasdair_ 7y agoI scraped 10 million records from linkedin a few years ago from a single ip by using their search function. I got a list of the top 1000 first names and top 1000 last names and wrote a script to query all combinations and scrape the results. This may or may not still work.
- Ididntdothis 7y agoYou probably have to be highly distributed. At least that’s what I did when I tried to scrape a large site some years ago. I had around 100 machines in different countries and gave each of them random pages to scrape.
- auiya 7y agoUsername checks out
- magashna 7y agoIt looks like the purpose was data enrichment, so maybe it was pieced together over time from multiple sources. My linkedin from PDL only had 1 bit of wrong info. I wasn't able to find anything on my personal email addresses which is good.
- tyri_kai_psomi 7y agoDistributed bot and scraper networks. Thousands of IPs geographically dispersed throughout the world. There is only so much you can do with rate limiting.
- 7y ago
- rohan1024 7y agoFirefox monitor can tell you if your information was leaked in data breaches. I don't think they have this data set though. https://monitor.firefox.com/ https://monitor.firefox.com/
- ordinaryradical 7y agoHighly recommended. You can put in multiple email addresses, so you can help monitor your non-technical family members’ info as well.
- shantly 7y agoAt this point practically everything about me's available either for free or a few dollars. The only interesting thing left is whether a given password has been compromised. The answer to everything else is "yes, it's been leaked". Been that way for most of a decade at this point, guessing it's the same for most other folks with any modern digital or banking presence whatsoever.
- bonestamp2 7y agoI'm sure there are search engines for it too but I noticed that credit karma can tell you which of your passwords have been associated with your email addresses in data breaches. Credit Karma is free but the CEO appears to be transparent in how they make money (recommending financial products to you based on what they see in your credit profile).
- farisjarrah 7y agoI am a very suspicious and wary internet user, hardly sign up for any services, but been using Credit Karma for my taxes and light financial monitoring for the last 3 years. Tax Filing was totally free and I got the tax refunds I was expecting. No issues with them whatsoever. I have never gotten any email or other spam as a result of using their service. I am a happy customer, though technically speaking I have never actually given them any money directly.
- kerng 7y agoSeems like the ball is with Google at the moment, the exposed data is on their GCP servers. So, they can figure out next steps.
- Scoundreller 7y agoImagine the equivalent in another industry: “Hello, Bank of America? There’s an ATM machine of yours that’s spitting out cocaine. Yes, I understand that it’s probably not your cocaine and that’s not your business, but don’t you think you should maybe shut it down?”
- lucb1e 7y agoBut would you call VendingMachinesCo because there is a vending machine outside the local supermarket, operated by said supermarket, that spits out cocaine? Pretty sure that whatever you put in there is the machine owner's responsibility, not the manufacturer. GCP does not put content in their VPSes themselves the way that a bank operates an ATM. I think it's more like the responsibility of an ISP to poke their noses in what they transfer, since it might be illegal content (similar to whether Google should poke their noses into people's VPSes). I'm not sure if we should want to require them to do that.
- quotemstr 7y agoGet a court order. No infrastructure company on its own should be making value judgements about what it hosts.
- bogwog 7y agoWhen will people start going to prison for stuff like this?
- sdinsn 7y agoFor what? For scraping public data?
- big_chungus 7y agoWhen there's a law against it and there's evidence of breaking that law.
- anilshanbhag 7y agoPeople data labs's data is pretty accurate. Here is mine: https://api.peopledatalabs.com/v4/person?api_key=9c6a13822048c34091683bc4ed9a6528d41e2529532cb6c20cc73287f731ef17&email=anilashanbhag@gmail.com&pretty=true https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204... You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.
- alanbernstein 7y agoThat API key is now public, too! Rate limited.
- big_chungus 7y agoYeah no kidding. Though if you wait until it flips to a new minute and refresh, that helps. Though it takes all of a minute to register a free key, so probably no big deal.
- netsharc 7y agoAh, looks like everyone's using that API key, I got 2 queries for my addresses and got a "rate limit exceeded" message. Strangely it only says I work in real estate (no I don't) when I looked up the email address I use for LinkedIn...
- badrequest 7y agoGenuinely hope somebody goes to prison for this, but not gonna hold my breath.
- roywiggins 7y agoThis data is accessible at small scales just by registering for a free api key at People Data Labs and making a GET request, and if you want more robust access you could just pay PDL for it.
- badrequest 7y agoSorry, I should have been clearer, I'm talking about whoever is responsible for leaving it completely open to the public internet.
- roywiggins 7y agoThe only person harmed directly seems to be PDL since they may find it harder to charge subscriptions for bulk access to the data. I am not sure why this stuff being online in bulk is so much worse than being online behind a paywall that someone should actually go to jail for it.
- cortesoft 7y agoI mean it is INTENTIONALLY exposed to the public... the only mistake is they are giving it away instead of charging for it. If you don't like it when they give out all the information for free, it doesn't make it better if they charge money.
- shadowgovt 7y agoDepending on the countries the data is hosted in and the attacker lives in, it's unclear any law has been broken that would land a person in jail. If PDL had a flaw in their implementation that allowed someone to scrape them (or they didn't and someone did the hard work of creating 1.2 million fake accounts to register for 1,000 free API calls), it might be an uphill battle to prove even "unauthorized access."
- sparkywolf 7y agoI found a vulnerability in linkedIn a few years back that allowed anyone to access a private profile (because client side validation was enough for them I guess..?) They didn't take my report seriously (still not completely patched) and I feel like that told me all I needed to know about their security practices.
- john-radio 7y agoI reported an issue to the LinkedIn competitor https://about.me https://about.me two years ago where signing in with my Google credentials gives me access to some the account of some random other person with a similar name to me. I think that during registration, I attempted to register about.me/johnradio (except it's not "johnradio"), but he was already using it, and then the bug occurred that gave me this access. I randomly check every 6 months or so and yep, still not fixed.
- simonlc 7y agoI actually had a similar thing happen with facebook, though we didnt share names.
- jonathankoren 7y agoFor a while, our Comcast billing account accessed some other person’s account. Comcast didn’t take it seriously, and just told us to create a new account and not use the old one. (!!!) We had full access. I could have signed this person up for the most expensive package, or even canceled their service.
- mythrowaway1124 7y agoLet's be realistic here. Everyone knows it's not possible to cancel Comcast service.
- adjkant 7y ago
- tempsy 7y agoI've gotten some strange spam phone calls this last week, including like 3 from Egypt. Wonder if this is why.
- giarc 7y agoProbably unrelated. These security researchers found this open database, it doesn't necessarily mean someone else found it.
- DavideNL 7y agoI wonder whether FB/Linkedin can manipulate the timing of negative news like this, for strategic reasons...
- apetresc 7y agoFacebook/LinkedIn are not implicated in the breach at all; it was some random third-party data enrichment service. The Facebook/LinkedIn in the title refers to the fact that people's FB/LI accounts were one of the fields in the database. So were their Github, and basically any other public-facing account that these scrapers can gather.
- rm_-rf_slash 7y agoGood thing I just updated my LinkedIn profile. Wouldn’t want hackers to think I have gaps in my resume.
- Antoninus 7y agoLinkedin the last social media membership I have. I’ve been mulling over whether to delete my account because I’m not sure how it will look to prospective employers.
- ars 7y agoI don't know about other people, but I have zero personal info with LinkedIn and Facebook. They only info they have about me is info I don't mind being public. If I want something to be private I don't tell it to them. It's as simple as that. Google on the other hand, knows lots of private things.
- nontoxyc 7y agoFacebook has a lot of personal information about you even if you have never had a Facebook account. For example: your GPS location data, approximate age, gender, ethnicity.... Welcome to the future komrade. Sadly, it's not a matter of just "not giving them" your location data. Your devices supply it.
- mixmastamyk 7y agoAnd your friends too. I dutifully kept a new number out of FB until a friend messaged me with, is this your number right? Xxx-xxx-xxx. They can also tag you and auto tag you through face recognition.
- dredmorbius 7y agoThrough shadow profiles, third-party submissions, cross-site cookie tracking, and integration of offline data records, this almost certainly is absolutely false. Unless you've directly pursued all legal (or otherwise) mechanisms to ascertain this directly, the best you can say is that you're unaware of any information that's been acquired, and that you didn't knowingly or intentionally contribute any yourself. The article here describes precisely this practice, in its fourth paragraph and following, in the section titled "Data Enrichment": For a very low price, data enrichment companies allow you to take a single piece of information on a person (such as a name or email address), and expand (or enrich) that user profile to include hundreds of additional new data points of information. As seen with the Exactis data breach, collected information on a single person can include information such as household sizes, finances and income, political and religious preferences, and even a person’s preferred social activities. Please let's put this canard to rest.
- deleted 7y ago[deleted]
- narrator 7y agoThis is why I lie about my birthdate by a couple of days on anything where it's not something like a medical record or where I am required to tell the truth for whatever reason. I also never provide my social security number unless it is required by law.
- karlding 7y agoOne of my coworkers generates a fake middle name for every service they sign up with. According to him, this serves as a unique identifier allowing them to determine when a service is selling their data to a third party (or data is being leaked).
- input_sh 7y agoFastmail has subdomain addressing, so if your email is jondoe@example.com, you can use hn@jondoe.example.com to sign up for HN. That way you'll know for sure who leaks your data, and nobody's going to strip it away like some services would strip away plus addressing (as in, johndoe+hn@example.com).
- archi42 7y agoI have excellent results with a subdomain. Even though PDL probably has a lot of data on me, they have (not yet?) been able to glue it to my primary mail address. That one only has my name, gender, github, country and name of my employer. They can't seem to map the remainder to anything else.
- thephyber 7y agoIt would be a shame if someone corrupted these ES indexes.
- arbuge 7y ago> 400 million+ phone numbers. 200 million+ US-based valid cell phone numbers. Sounds like a nightmare in the making for those cell phone users and their carriers when those begin to get SIM jacked.
- cm2187 7y agoI think cold calling could be an even bigger nuisance. My DNS provider published my phone number by mistake on a whois when I registered a domain, I spotted it immediately and it was corrected within hours. Over a year later I still receive cold calls from India to sell me web services at least once or twice a week. Imagine if you can match everyone’s position with a mobile phone, a dream for tele marketers, tailors, scammers, etc...
- pc86 7y agoIs that all you need to SIM jack a phone? The phone number?
- peterwwillis 7y agoYes and no. You need a phone number, but you still need to carry out a variation of an attack that replaces the SIM associated with that phone number. Sometimes this is carrier-specific. Sometimes it's trivial, sometimes it requires a menial amount of work, and in extreme cases you might have to access an actual network. Most of the time there is nothing stopping the attack if they have your personal information.
- shadowgovt 7y agoIt's a tragedy that all of this data was available to anyone in a public database instead of.... checks notes... available to anyone who was willing to sign up for a free account that allowed them 1,000 queries. It seems like PDL's core business model is irresponsible regarding their stewardship of the data they've harvested.
- godelski 7y agoWould it be better if this was a paid service? If the issue access to the data, then maybe we should ask if this data should be collected in the first place.
- amerine 7y agoThat is OPs point.
- chmod775 7y ago> If the issue access to the data, then maybe we should ask if this data should be collected in the first place. Outlawing the collection of data would be hard and is unlikely to work, but the fact that companies like AT&T are allowed to sell your data, as they did with OP's (where else would that unused phone number come from), is an angle new legislation can use. The EU now already has a piece of legislation aimed at stifling these practices. The US and other economies just need to follow suit.
- jakemal 7y agoIt seems like that is starting to happen with California's new data privacy law. I'm starting to get a lot of privacy policy update emails like I did when GDPR took effect.
- godelski 7y agoI'm more thinking that not all data is equal. We really treat it like it is, at least from the public perspective (it clearly isn't from the perspective of those gathering data, but there's a clear disparity in how these groups view things). Some data is actually necessary to give up to have a well functioning internet (what browser you're using) and some data is not (canvas fingerprinting). There's a tough question here because the people making the decision of what data to be used is not us. It is the websites we visit. I would argue that there is no consent being given here and all is assumed to be "common consent" (which I'm using as a lack for better terms. Things like that if you walk out in public people can see you. But conversely, someone can't run up to you and measure your height with a tape measure). There has to be some balance here. What that is, I don't know. But really the only people that can figure that out are us computer nerds who at least kinda understand these things. We have to be having these discussions, or else it becomes "fuck silicon valley" (a conversation that is becoming national). So if we don't think about these things, then we clearly live in a bubble and bubbles burst. If we do think about these things, maybe we don't live in a bubble.
- octocop 7y agoWhere can i download the data?
- ngneer 7y agoUgh. To whomever is currently wasting their time and effort on differential privacy, take a good long look.
- padraigoleary 7y agoWhy? Interested in why you think differential privacy would make any difference... The fault here seems to be an open es server.
- ngneer 7y agoThat is precisely my point. Differential privacy would NOT make any difference, and I was pointing the many folks who are working on it to the much simpler issues that are in fact being encountered in the field. This past IEEE S&P had quite a few theoretical privacy talks.
- jillesvangurp 7y agoI was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad-1911-145091.html https://www.golem.de/news/elasticsearch-datenleak-bei-conrad..., in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to 'fix' that and then went on to make sure the thing was reachable from the public internet on a non standard port that on most OSes would require you to disable the firewall or open a port. The ES manual section for network settings is pretty clear about this with a nice warning at the top: "Never expose an unprotected node to the public internet." Giving read access is one thing. I bet this thing also happily processes curl -X DELETE "http:<ip>:9200/*" (deletes all indices). Does it count as a data breach when somebody of the general public cleans up your mess like that? In any case, Elasticsearch is a bit of a victim of its own success here and may need to act to protect users against their own stupidity since clearly masses of people who arguably should not be taking technical decisions now find it easy enough to fire up an Elasticsearch server and put some data in it (given the amount of companies that seem to be getting caught with their pants down). It's indeed really easy to setup. But setting it up properly still requires RTFMing, dismissing the warning above, and having some clue about what ip addresses and ports are and why having a database with full read write access on a public ip & port is a spectacularly bad idea.
- jerrac 7y agoI've been using ES off and on since before 1.0 came out. It has always baffled me that ES doesn't require a username and password by default. ES is a database that has to exist on a network to be usable. Heck, it expects that you have multiple nodes, and will complain if you don't. So one of the first things you do is expose it to the network so you can use it. Yes, it takes some serious incompetence to not realize you need to secure your network, but why in the world would you not add basic authentication into ES from the start? I'd never design a tool like a database without including authentication. I am serious about my question. Could anyone clue me in?
- 7y ago
- codeulike 7y agoThere's estimated to be 4.4 billion internet users in 2019, so this is over 25% of people on the internet.
- avocado4 7y agoIs Elastic going to be punished under GDPR especially given that it's a Dutch company?
- arpa 7y agoThat is a terrifying thought with terrible chilling effect should somebody official would even voice this thought in any way.
- avocado4 7y agoWas this an AI-generated sentence?
- rvrabec 7y agoReally interesting legal question - "Seems like the ball is with Google at the moment, the exposed data is on their GCP servers. So, they can figure out next steps." is a comment above. How will the chain of insecure infrastructure + the data scrapers + the people responsible for configuration react?
- neiman 7y agoIsn't it creepy that People Data Labs, "a data aggregator and enrichment company", collected data on 1.2 billion people? Isn't it exactly what GDPR came to prevent? Are there no Europeans among this group?
- longbanana 7y agoGood luck in prison, Henry
- zmmmmm 7y agoFrom what I could see the data returned on me was all derived from publicly available sources (eg: my "public" LinkedIn page, my public github page etc). Perhaps others have more but this looks more like an aggregator of public information than a breach of non-public information. Having said that, I find these companies unspeakably evil - their intent is to make money by harming people (eroding their privacy by making otherwise private personal information easier to get, obviously a gold mine for identity thieves etc).
- harikb 7y agoUnless we go after every customer who used the services of PDL, nothing is going to change. We will see a $3 fine per individual after 1 or 2 years of talking about this.
- StillBored 7y agoI think the solution here is laws which require anonymity, and that includes in banking (where it will never happen). That is because a couple days ago, I got a text message from tmobile (which seemed genuine) basically saying that my account was one of a larger subset of prepaid phone accounts which had been compromised and that my personal information had been potentially taken by "hackers". To which I got a good chuckle, because tmobile is one of the few phone companies that will let you create completely anonymous prepaid accounts using cash and without filling out any information. AKA you buy a sim card for $$$ and that is it. So, basically the only information they lost of mine as far as I can tell, is the phone number and type of phone I'm using (which they gather from their network). If they got the "meta" data about usage/location/etc that would have been different but it didn't sound like the hacker got that far. Had this been a post-paid account they would have my name/address/SSN/etc.
- TheSpiceIsLife 7y agoDo you think it’s reasonable to believe your name / address / SSN / DOB / etc is already out there? I’m of the opinion it’s too late for prevention and we need, instead, mitigation.
- a3n 7y agoExactly. The very reason for existence of the two companies, pdl and oxy, is to tie n pieces of data with m pieces of data. So depending on how the "anonymous" phone number was used, it's plausible that the number can be connected with other PII. In fact I wonder if there is any such thing as non-PII, given the existence of such companies.
- ryandrake 7y agoCompanies need to stop treating knowledge of this information as proof that you are who you say you are. I would have no problem publicly posting my name, social security number, birthday, mother's maiden name, etc., if not for the fact that someone can actually use this information to open a bank account or take out a loan in my name. It's ridiculous that this is all it takes in most cases.
- slg 7y agoThe number in the HN headline was changed from 1.2 billion to 1 billion (despite the original source's headline saying 1.2). It is kind of amazing that leaking the personal data of 200 million people is now just a rounding error that can be dropped from headlines.
- class4behavior 7y agoImho, it's more impressive that it's basically a non-story outside of it security news.
- trickstra 7y agoThe general public just shrugs upon hearing such news. They still think there is nothing dangerous if their data gets leaked.
- mjparrott 7y agoIt should be illegal for any company to store my private information like this. The 'anonymous' sharing of my information is easily de-anonymized. Sites asking for your phone number for "security purposes" are a joke. You just have to accept that absolutely everything you've done online is public information. If it isn't now, it is being stored and future tools / databases will make what is either difficult to access or difficult to interpret very easy to use in the future.
- breischl 7y agoUsing phone number as an example of private information is pretty hilarious. Remember when the phone company used to literally print your name and phone number in a book and send it to everyone in your town? Man, their security was terrible! But it works perfectly fine as a two-factor auth mechanism to prove that whoever setup the account is the same person trying to log into it at some later time.
- perl4ever 7y agoBirthday is commonly used to verify people despite the practice of broadcasting it to people on Facebook.
- deleted 7y ago[deleted]
- lopmotr 7y agoWhat private information? If you give a random website your email address or phone number, it's not private anymore and you're the one who released the secret. Unless they promised to keep it private in a legally binding way, in which case, your wish is already true.
- Anthony-G 7y agoSuch a cavalier attitude to the storage of EC citizens' personal data is illegal under Article 32 of the GDPR: https://www.gdpr.org/regulation/article-32.html https://www.gdpr.org/regulation/article-32.html Citizens of the US really need similar protections.
- krn 7y ago> Analysis of the “Oxy” database revealed an almost complete scrape of LinkedIn data, including recruiter information. "Oxy" most likely stands for Oxylabs[1], a data mining service by Tesonet[2], which is a parent company of NordVPN. It is probably safe to assume, that LinkedIn was scraped using a residential proxy network, since Oxylabs offers "32M+ 100% anonymous proxies from all around the globe with zero IP blocking". [1] https://oxylabs.io/ https://oxylabs.io/ [2] https://litigation.maxval-ip.com/Litigation/DetailView?CaseID=Epee88Womxg%3D&logstat=false&Party=Luminati%20Networks%20Ltd.%20v.%20UAB%20Tesonet https://litigation.maxval-ip.com/Litigation/DetailView?CaseI...
- gorbachev 7y agoHow is that possible? LinkedIn blocked mining the data this way several years ago. Is it still possible if you pay LinkedIn enough? Or is this old data?
- tyingq 7y agoA large number residential proxies and fake LinkedIn accounts would look the same to LinkedIn as normal browsing.
- gorbachev 7y agoThere's information on the leak that wouldn't be widely available without accessing LinkedIn data using their APIs. Phone numbers and emails, for example.
- tyingq 7y agoThe article mentions it is a blend of data from http://oxydata.io/ http://oxydata.io/ and https://www.peopledatalabs.com/ https://www.peopledatalabs.com/ Both are aggregators that get data from many sources, correlate them, and sell it. The phone numbers and emails could have come from anywhere. See this screenshot from PeopleDataLabs: https://d1ennknj6q36vm.cloudfront.net/images/cblead.png https://d1ennknj6q36vm.cloudfront.net/images/cblead.png
- OkGoDoIt 7y agoThe IP address in question does not seem to be working at this time. Clearly whoever runs the server has shut off access. I wonder if someone managed to save a data dump somewhere?
- 83-qw-13-f4-as 7y agoWhen this type of leak happens, where does this data actually appear? On the dark web? Who has access to this and how does one get it?
- outworlder 7y agoWhy are there people running anything publicly accessible? If you are running on the cloud, there is no need for any VMs to have any public IPs at all. Exception for your Bastion host, and even that should be restricted to known networks. All incoming traffic needs a layer of indirection. On cloud providers that's usually their load balancers.
- WA 7y agoI wonder how high the GDPR fine will be.
- hnick 7y agoI guess it's time to start leaking billions of records of junk data to pollute the waters.
- CriticalCathed 7y agoIs this public facing information that's been crawled, collected, and categorized?
- williesleg 7y agoJust doing the needful.
- aussieguy1234 7y agoIs it illegal to download/scrape data from a wide open database like this one?
- deleted 7y ago[deleted]
- musicale 7y ago>According to their website, the PDL application can be used to search: Over 1.5 Billion unique people, including close to 260 million in the US. Over 1 billion personal email addresses. Work email for 70%+ decision makers in the US, UK, and Canada. Over 420 million Linkedin urls Over 1 billion facebook urls and ids. 400 million+ phone numbers. 200 million+ US-based valid cell phone numbers. Too bad there aren't any laws regulating this sort of private data aggregation and sale. Well, besides GDPR (which apparently isn't enforced) and CCPA (which won't be enforced either.)
- _-___________-_ 7y agoES is the new Mongo. If you make software this easy to use, then people with little or no experience are going to use it. Just have secure defaults, like authentication, how many times do we have to learn this lesson...
- eyeball 7y agoIs there any way to see what data they had on me?
- chiefalchemist 7y ago"including close to 260 million in the US." So basically, _everyone_ in the USA minus those not online. And I bet this will go unreported by the mainstream media.
- jka 7y agoThere's a video at https://www.youtube.com/watch?v=VNLEEogFo18 https://www.youtube.com/watch?v=VNLEEogFo18 where People Data Labs' chief executive speaks at an insurance conference this year about their business. They describe the data as being sourced from a 'data co-op' of over 1k companies which share data. It wasn't clear whether that means that those companies are collaborating and pooling data, or whether it's a roundabout/wordy way of saying that they scrape public personal information from thousands of sites. They also claim that they're GDPR and CCPA compliant; I'm no expert but I do find one or two references that seem to suggest that scraping EU citizens' personal data without consent hasn't been GDPR-compliant for some time. It does also raise another question: even if PDL themselves aren't GDPR-compliant, would any resulting fines against them reclaim a significant portion of the utility captured from the distribution of that data? As per comments on this thread, PDL API keys seem to be free to create. Hypothetically speaking it could be within the interests of a group of businesses to provide a small amount of funding towards operation(s) that harvest and redistribute personal data: if the revenue base is low, the operation(s) can eventually fail (once legal proceedings catch up with them) and the group as a whole incurs little cost. The speaker also takes a question from the audience regarding potential use-cases for this kind of personal data, and answers that knowing about an individual's life events (such as marriage) can be an opportunity to sell products to them, as can differentiating pricing if they'd just started smoking cigarettes. Although I'm no expert, my understanding of insurance has been that risk is spread across a large pool of customers, allowing them each to pay similar premiums despite potentially slightly different backgrounds, with the understanding that they mutually benefit by paying into a shared fund so that the (random, potentially high-cost) risk of loss to each member is greatly softened. We're seeing a situation here where more precise, per-individual data is being collected across large populations and could potentially be used for price differentiation. If the insurance industry doesn't defend itself, this could lead to premiums which are essentially calculations based on 'pre-existing data' -- information which the consumer may not have consented to sharing, and which an insurance company might not be able to collect from application forms. We don't seem to be particularly good, collectively, at escaping from cycles which seem to introduce or further wealth disparity at the moment and I worry that this kind of tech-driven attempt to optimize revenue efficiency of the insurance industry would only lead to further inequality.
- naniwaduni 7y ago"1B" is a surprisingly bad abbreviation here, considering its resemblance to a much ... less impressive number.
- magnusss 7y agoLet me make sure I understand: If I take gigabytes of “enriched” personal information and make it available to the public for free, then I’m an irresponsible, idiotic, incompetent buffoon. But if I put a paywall in front of it and sell that same data for a fair price, then I’m a business genius? Seems to me that if the data is legally acquired and can be legally distributed, doing so at a cost of zero does not constitute a data leak. It may be bad business, but since when is that a crime?
- lonelappde 7y agoWelp, time to change all my passwords, maiden names, and friendships.
- otakucode 7y agoDoes this mean we don't need to do a census any more?
- aww_dang 7y agoCyber alarmists would call a telephone directory: 'A verified threat incident'. Yet these are the same companies selling OSINT data. These alarmist groups need to put down the buzzwords, step off from their white horse and take a look at the hypocrite in the mirror. If you use social networks, you don't have a reasonable expectation of privacy. You've published your data publicly. If you want to keep this information private, then don't publish it on the Internet. From: http://www.dmlp.org/legal-guide/publication-private-facts http://www.dmlp.org/legal-guide/publication-private-facts >2. Private Fact: The fact or facts disclosed must be private, and not generally known.
- thelittleone 7y agoData Enrichment Companies. Marketing speak for highly vulnerable privacy eradication service. Vote #1 for some sort of global GDPR where these businesses are no longer profitable.
- rcarmo 7y agoI just had a look at “my” data on this and it is almost hilariously wrong.
- sideshowb 7y agoWhere can we look up our data?
- Pywarrior 7y agowhere cam i download the leaked data?
- sbhn 7y agoIs it ok if i monetise the data by being a consultant for it aswell? Just you like are. Have you made much money on it yet?
- hutzlibu 7y agoMaybe I am missing something here, but I do not really see the scandal here with the "leak" and I rather think the term is missleading in this context. What happened? As far as I understand, there are companies who search the web for public data of people like me, without my consent. Then they sell that data. Also without my consent. So that data was avaiable anyway, allmost for free. If this data would contain sensitive information, then I see this buisness practice as a scandal. But the mere fact that all this data which was gathered without consent is now avaiable for free because of possible db missconfiguration .. is not a scandal to me. And a leak is usually when a company loses sensitive data of its customers, who expected that data to remain confident, like emails. Not what happened here. Feels more like PR.
- johnchristopher 7y agoIs there a way for an individual to check if he's in the dataset ? I am curious about what kind of data they'd have aggregated around me.
- roshanravan 7y agothat IP:9200 address is down, any mirrors?
- roshanravan 7y agoTo check if you're affected use haveibeenpwned.com