Overview

• A major data breach involving Gravy Analytics has exposed sensitive location data from over 10,000 popular apps, including Tinder, Candy Crush, Spotify, and Vinted.
• The leaked data, reportedly sourced through real-time bidding (RTB) in the advertising ecosystem, includes GPS coordinates, IP addresses, and location histories of millions of users worldwide.
• The breach highlights privacy risks, as the stolen data could be exploited for scams, blackmail, or further unauthorized access by bad actors and criminal organizations.
• Gravy Analytics, which sells location data to commercial and government clients, is under scrutiny for its practices, with the Federal Trade Commission previously penalizing the company for privacy violations.
• Experts urge users to limit app permissions and review settings to mitigate risks, as many apps collect location data without users' full awareness or consent.