DataSpii (pronounced data-spy) is a
leak
A leak is a way (usually an opening) for fluid to escape a container or fluid-containing system, such as a Water tank, tank or a Ship, ship's Hull (watercraft), hull, through which the contents of the container can escape or outside matter can e ...
that directly compromised the private data of as many as 4 million
Chrome and
Firefox
Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation. It uses the Gecko rendering engine to display web pages, which implements curr ...
users via at least eight
browser extension
A browser extension is a software module for customizing a web browser. Browsers typically allow users to install a variety of extensions, including user interface modifications, cookie management, ad blocking, and the custom scripting and st ...
s.
The eight browser extensions included Hover Zoom, SpeakIt!, SuperZoom, SaveFrom.net Helper, FairShare Unlock, PanelMeasurement, Branded Surveys, and Panel Community Surveys. The private data included personally identifiable information (PII), corporate information (CI), and government information (GI). DataSpii impacted
the Pentagon
The Pentagon is the headquarters building of the United States Department of Defense, in Arlington County, Virginia, across the Potomac River from Washington, D.C. The building was constructed on an accelerated schedule during World War II. As ...
,
Walmart
Walmart Inc. (; formerly Wal-Mart Stores, Inc.) is an American multinational retail corporation that operates a chain of hypermarkets (also called supercenters), discount department stores, and grocery stores in the United States and 23 other ...
,
AT&T
AT&T Inc., an abbreviation for its predecessor's former name, the American Telephone and Telegraph Company, is an American multinational telecommunications holding company headquartered at Whitacre Tower in Downtown Dallas, Texas. It is the w ...
,
Zoom,
Bank of America
The Bank of America Corporation (Bank of America) (often abbreviated BofA or BoA) is an American multinational investment banking, investment bank and financial services holding company headquartered at the Bank of America Corporate Center in ...
,
Sony
is a Japanese multinational conglomerate (company), conglomerate headquartered at Sony City in Minato, Tokyo, Japan. The Sony Group encompasses various businesses, including Sony Corporation (electronics), Sony Semiconductor Solutions (i ...
,
Kaiser Permanente
Kaiser Permanente (; KP) is an American integrated delivery system, integrated managed care consortium headquartered in Oakland, California. Founded in 1945 by industrialist Henry J. Kaiser and physician Sidney Garfield, Sidney R. Garfield, the ...
,
Apple
An apple is a round, edible fruit produced by an apple tree (''Malus'' spp.). Fruit trees of the orchard or domestic apple (''Malus domestica''), the most widely grown in the genus, are agriculture, cultivated worldwide. The tree originated ...
,
Facebook
Facebook is a social media and social networking service owned by the American technology conglomerate Meta Platforms, Meta. Created in 2004 by Mark Zuckerberg with four other Harvard College students and roommates, Eduardo Saverin, Andre ...
,
Microsoft
Microsoft Corporation is an American multinational corporation and technology company, technology conglomerate headquartered in Redmond, Washington. Founded in 1975, the company became influential in the History of personal computers#The ear ...
,
Amazon
Amazon most often refers to:
* Amazon River, in South America
* Amazon rainforest, a rainforest covering most of the Amazon basin
* Amazon (company), an American multinational technology company
* Amazons, a tribe of female warriors in Greek myth ...
,
Symantec,
FireEye,
Trend Micro,
Boeing
The Boeing Company, or simply Boeing (), is an American multinational corporation that designs, manufactures, and sells airplanes, rotorcraft, rockets, satellites, and missiles worldwide. The company also provides leasing and product support s ...
,
Tesla,
SpaceX
Space Exploration Technologies Corp., commonly referred to as SpaceX, is an America, American space technology company headquartered at the SpaceX Starbase, Starbase development site in Starbase, Texas. Since its founding in 2002, the compa ...
,
Pfizer
Pfizer Inc. ( ) is an American Multinational corporation, multinational Pharmaceutical industry, pharmaceutical and biotechnology corporation headquartered at The Spiral (New York City), The Spiral in Manhattan, New York City. Founded in 184 ...
, and
Palo Alto Networks.
Highly sensitive information (e.g., private network topology) associated with these corporations and agencies was intercepted and sent to foreign-owned entities.
The data was made publicly available via Nacho Analytics (NA), a marketing intelligence company which described itself as "god mode for the internet."
Both paid and free-trial members of NA were provided access to the leaked data. Upon signing up for NA membership, members were then provided access to the data via a
Google Analytics
Google Analytics is a web analytics service offered by Google that tracks and reports website traffic and also mobile app traffic and events, currently as a platform inside the Google Marketing Platform brand. Google launched the service in N ...
account.
DataSpii leaked un-redacted information related to medical records, tax returns, GPS location, travel itinerary, genealogy, usernames, passwords, credit cards, genetic profiles, company memos, employee tasks, API keys, proprietary source code, LAN environment, firewall access codes, proprietary secrets, operational materials, and zero-day vulnerabilities.
DataSpii was discovered and elucidated by cybersecurity researcher
Sam Jadali. By requesting data for a single domain via the NA service, Jadali was able to observe what staff members at thousands of companies were working on in near real-time. The NA website stated it collected data from millions of opt-in users. Jadali, along with journalists from Ars Technica and The Washington Post, interviewed impacted users, including individuals and major corporations.
According to the interviews, the impacted users did not consent to such collection.
References
{{Reflist
Data security
Data breaches