# Hackers Claim Massive Breach of Location Data Giant (Gravy Analytics), Threaten to Leak **URL:** https://discuss.privacyguides.net/t/hackers-claim-massive-breach-of-location-data-giant-gravy-analytics-threaten-to-leak/23832 **Category:** General **Tags:** article **Created:** 2025-01-07T22:03:56Z **Posts:** 12 ## Post 1 by @jerm — 2025-01-07T22:03:57Z [https://archive.is/iAQ7d](https://archive.is/iAQ7d) > Hackers claim to have compromised Gravy Analytics, the parent company of Venntel which has sold masses of smartphone location data to the U.S. government. The hackers said they have stolen a massive amount of data, including customer lists, information on the broader industry, and even location data harvested from smartphones which show peoples’ precise movements, and they are threatening to publish the data publicly. > The samples of data posted by the hackers include the apparent historical location of smartphones. The files contain precise latitude and longitude coordinates of the phone, and the time at which the phone was there. Some screenshots indicate what country the data has been collected from. One alphabetically ordered list mentions Mexico, Morocco, Netherlands, North Korea, Pakistan, and “Palestinian State (proposed).” That is only a snapshot of where Gravy sourced data from; one file includes location data relating to phones in Russia, and U.S. agencies have [previously used such data](https://archive.is/o/iAQ7d/https://www.wsj.com/articles/federal-agencies-use-cellphone-location-data-for-immigration-enforcement-11581078600) as part of immigration operations on the country’s border. (Gravy [provides some of its data to subsidiary Venntel](https://archive.is/o/iAQ7d/https://www.vice.com/en/article/ice-dhs-fbi-location-data-venntel-apps/?ref=404media.co), which then works directly with those and other agencies). > Another screenshot shows classifiers that Gravy has added to collected data, such as “LIKELY\_DRIVING.” --- ## Post 2 by @Surreal — 2025-01-10T00:08:18Z Candy Crush, Tinder, MyFitnessPal: See the thousands of apps hijacked to spy on your location A hack of location data company Gravy Analytics has revealed which apps are—knowingly or not—being used to collect your information behind the scenes. Source: [https://bsky.app/profile/404media.co/post/3lfdm7xcgc222](https://bsky.app/profile/404media.co/post/3lfdm7xcgc222) --- ## Post 3 by @Surreal — 2025-01-10T00:19:49Z I would assume potential mitigations of this could be done with various tracker blocking DNS providers and/or Pi-hole? I know some apps bypass that using their own DoT or DoH. --- ## Post 4 by @TinFoilHat — 2025-01-10T01:30:23Z Thanks for the link, just found another post from 404Media providing WIRED version of the same report (which is not paywalled) > **[404 Media (@404media.co)](https://bsky.app/profile/404media.co/post/3lfdqhu7x622l)** > > We have a partnership with @wired.com you can read their version here: > > 🔗 https://www.wired.com/story/gravy-location-data-app-leak-rtb/ --- ## Post 5 by @TinFoilHat — 2025-01-10T01:36:56Z [From what I can find](https://github.com/celzero/rethink-app/issues/25), Private DNS is quite robust and apps shouldn’t be able to bypass private DNS, unless they embed IP address in their app in case the DNS query got refused, some apps do that, e.g. [WeChat](https://play.google.com/store/apps/details?id=com.tencent.mm) (I learnt this when I was setting up Private DNS for someone). --- ## Post 6 by @Valynor — 2025-01-10T01:53:28Z From the blocklists I’m using only HaGeZi - Multi PRO++ seems to block gravy analytics. > **[GitHub - hagezi/dns-blocklists: DNS-Blocklists: For a better internet - keep the...](https://github.com/hagezi/dns-blocklists)** > > DNS-Blocklists: For a better internet - keep the internet clean! Highly recommended list. --- ## Post 8 by @Surreal — 2025-01-10T04:26:06Z > [@Anon47486929](#): > > The solution to this imo is to use better apps. Tinder, Candy Crush, etc. are known “bad” apps. The WIRED article links to a Google sheet with 12,372 listed apps affected. That’s quite a lot. “_The full list can be found [here](https://docs.google.com/spreadsheets/d/1Ukgd0gIWd9gpV6bOx2pcSHsVO6yIUqbjnlM4ewjO6Cs/edit?usp=sharing). Multiple security researchers [have published](https://pastejustit.com/atnbotturr) [other lists](https://gist.github.com/fs0c131y/f498b21cba9ee23956fc7d7629262e9d) of apps included in the data, of varying sizes._” --- ## Post 10 by @TinFoilHat — 2025-01-10T09:18:05Z AFAIK there are certain traffic bypasses VPN, but not private DNS, therefore prob. utilising private DNS would be better in this case. But it is certainly better just to use better apps. --- ## Post 11 by @anon42475305 — 2025-01-10T09:51:49Z Perhaps it shouldn’t come as a surprise, but it seems to me that many of these apps are blatantly lying in the ‘Data safety’ category on the Google Play Store. I would honestly expect Google to at least take action when these apps when they are caught lying. For example: > **Table of Top 10 Apps on List with Third-Party Location Sharing Disclosure(s)** > > | App Name | Package | Ion | Third-Party Location Sharing | > | --- | --- | --- | --- | > | Weather & Radar | de.wetteronline.wetterapp | 360977 | Approximate location: Analytics, Advertising or marketing Precise location: Advertising or marketing | > | Block Blast! | com.block.juggle | 212608 | No data shared with third parties | > | Candy Crush Saga | com.king.candycrushsaga | 175503 | Approximate location: Advertising or marketing | > | Happy Color®: Coloring Book | com.pixel.art.coloring.color.number | 120648 | Approximate location: Analytics, Advertising or marketing, Fraud prevention, security, and compliance | > | Words of Wonders: Crossword | com.fugo.wow | 78771 | No location data shared with third parties | > | Vita Mahjong | com.vitastudio.mahjong | 68649 | No data shared with third parties | > | Number Match - Number Games | com.easybrain.number.puzzle.game | 68320 | Approximate location: Analytics, Advertising or marketing, Fraud prevention, security, and compliance | > | Mahjong Club - Solitaire Game | com.gamovation.mahjongclub | 51093 | Approximate location: Analytics, Advertising or marketing, Personalization | > | QBlock: Wood Block Puzzle Game | puzzle.blockpuzzle.cube.relax | 42668 | No data shared with third parties | > | Woodle Screw Jam: Nuts & Bolts | com.wood.bolt.wordle.screw.nuts.puzzle | 42367 | No location data shared with third parties | Given that Gravy Analytics is a location tracking company, it seems to me that as many as 50% of the top ten apps on this list are potentially lying about the fact that they are sharing location data with third-parties. --- ## Post 12 by @Surreal — 2025-01-11T00:11:01Z > [@anon42475305](#): > > many of these apps are blatantly lying in the ‘Data safety’ category on the Google Play Store. I suspect the same is true for the iOS AppStore equivalent (Developer’s Privacy **self** attestation). Even Apple acknowledges they don’t verify what the Developer attests to: “_The developer indicated that the app’s privacy practices may include handling of data as described below. This information has not been verified by Apple. For more information, see the developer’s privacy policy._ _To help you better understand the developer’s responses, see Privacy Definitions and Examples._ _Privacy practices may vary, for example, based on the features you use or your age._”