A single, mysterious server exposed 1.2 billion user records

No one knows who owns the Google Cloud drive that exposed 1.2 billion user records, seemingly merged from data-brokers like People Data Labs and Oxydata, who may have simply sold the data to a customer that performed the merge operation and then stuck the resulting files on an unprotected server, which was discovered in October by researcher Vinny Troia using Binaryedge and Shodan.

The data merges home and cell numbers, social media profiles, work histories and email addresses; as Troia says, "This is the first time I've seen all these social media profiles collected and merged with user profile information into a single database on this scale. From the perspective of an attacker, if the goal is to impersonate people or hijack their accounts, you have names, phone numbers, and associated account URLs. That's a lot of information in one place to get you started."

The brokers don't think they were breached. PDL founder Sean Thorne hypothesized that some of the data his company nonconsensually gathered on 1.5 billion people was sold to a normal customer who mishandled it and that is "their responsibility."

Oxydata exec Martynas Simanauskas said that while his company sells its nonconsensual dossiers on terms that require its customers to manage the data conservatively, "there is no way for us to enforce all of our clients to follow the best data protection practices and guidelines."

They're totally right about one thing: once you gather and sell this data, you can't control it -- it's pluripotent, omnitoxic, and immortal. Read the rest