Hackers claim to have compromised Gravy Analytics, the parent company of Venntel which has sold masses of smartphone location data to the U.S. government.  The hackers said they have stolen a massive amount of data, including customer lists, information on the broader industry, and even location data harvested from smartphones which show peoples’ precise movements, and they are threatening to publish the data publicly.

The news is a crystalizing moment for the location data industry. For years, companies have harvested location information from smartphones, either through ordinary apps or the advertising ecosystem, and then built products based on that data or sold it to others. In many cases, those customers include the U.S. government, with arms of the military, DHS, the IRS, and FBI using it for various purposes. But collecting that data presents an attractive target to hackers.

“A location data broker like Gravy Analytics getting hacked is the nightmare scenario all privacy advocates have feared and warned about. The potential harms for individuals is haunting, and if all the bulk location data of Americans ends up being sold on underground markets, this will create countless deanonymization risks and tracking concerns for high risk individuals and organizations,” Zach Edwards, senior threat analyst at cybersecurity firm Silent Push, and who has followed the location data industry closely, told 404 Media. “This may be the first major breach of a bulk location data provider, but it won't be the last.”

In a message posted to two Gravy websites, the hackers wrote that “Personal data of millions users is affected,” according to screenshots posted on Russian cybercrime forum XSS. The forum is typically not publicly accessible but a source with access provided 404 Media with the screenshots and sample data posted by the hackers. “Company have 24h to answer or we will start to publish data,” the message continues.

The samples of data posted by the hackers include the apparent historical location of smartphones. The files contain precise latitude and longitude coordinates of the phone, and the time at which the phone was there. Some screenshots indicate what country the data has been collected from. One alphabetically ordered list mentions Mexico, Morocco, Netherlands, North Korea, Pakistan, and “Palestinian State (proposed).” That is only a snapshot of where Gravy sourced data from; one file includes location data relating to phones in Russia, and U.S. agencies have previously used such data as part of immigration operations on the country's border. (Gravy provides some of its data to subsidiary Venntel, which then works directly with those and other agencies).

Another screenshot shows classifiers that Gravy has added to collected data, such as “LIKELY_DRIVING.”

A file called “users” included in a sample of data posted by the hackers includes multiple well known companies such as Gannett, Uber, Comcast, Apple, LexisNexis, Equifax, and many more. It also specifically mentions Babel Street, which is another U.S. government contractor. This corroborates 404 Media’s earlier reporting on where Babel Street sourced its location data from, at least in part. 404 Media and a group of other outlets previously showed how Babel Street’s Locate X tool can be used to track visitors to out-of-state abortion clinics.

Demonstrating the depth of the alleged compromise, other screenshots posted by the hackers indicate access into Gravy’s infrastructure, including root access on a Gravy-associated Ubuntu server, control over Gravy’s domains, and access to Amazon S3 buckets which are often used to store massive amounts of data. In another posted message, the hackers claimed to have access since 2018.

At the time of writing, Gravy’s website is down. Usually that website redirects to Unacast, which acquired Gravy in 2023. Unacast executives did not respond to multiple requests for comment.

“For years, this data has been sold to corporate and government interests but it's never been widely available to all the threat actors targeting Western users. This type of data has been used to track visits to abortion clinics, sensitive government locations, and locations which could identify sensitive protected qualities of people like their sexual orientation,” Edwards continued. “This data could tell a threat actor where you take your kids to school, where you work, and where you spend leisure time. It's long overdue for Congress to pass a comprehensive federal privacy bill that puts safeguards on the collection of this type of sensitive data.”

Meta’s HR team is deleting internal employee criticism of new board member, UFC president and CEO Dana White, at the same time that CEO Mark Zuckerberg announced to the world that Meta will “get back to our roots around free expression,” 404 Media has learned. Some employee posts questioning why criticism of White is being deleted are also being deleted. 

Monday, Zuckerberg made a post on a platform for Meta employees called Workplace announcing that Meta is adding Dana White, John Elkann, and Charlie Songhurst to the company’s board of directors (Zuckerberg’s post on Workplace was identical to his public announcement). Employee response to this was mixed, according to screenshots of the thread obtained by 404 Media. Some posted positive or joking comments: “Major W,” one employee posted. “We hire Connor [McGregor] next for after work sparring?,” another said. “Joe Rogan may be next,” a third said. A fourth simply said “LOL.”

But other employees criticized the decision and raised the point that there is video of White slapping his wife in a nightclub; White was not arrested and was not suspended from UFC for the domestic violence incident. McGregor, one of the most famous UFC fighters of all time, was held liable for sexual assault and was ordered by a civil court to pay $260,000 to a woman who accused him of raping her in 2018. McGregor is appealing the decision. 

“Kind of disheartening to see people in the comments celebrating a man who is on video assaulting his wife and another who was recently convicted of rape,” one employee commented, referring to White and McGregor. “I can kind of excuse individuals for being unaware, but Meta surely did their due diligence on White and concluded that what he did is fine. I feel like I’m on another planet,” another employee commented. “We have completely lost the plot,” a third said. 

Several posts critical of White were deleted by Meta’s “Internal Community Relations team” as violating a set of rules called the “Community Engagement Expectations,” which govern internal employee communications. In the thread, the Internal Community Relations team member explained why they were deleting content: “I’m posting a comment here with a reminder about the CEE, as multiple comments have been flagged by the community for review. It’s important that we maintain a respectful work environment where people can do their best work. We need to keep in mind that the CEE applies to how we communicate with and about members of our community—including members of our Board. Insulting, criticizing, or antagonizing our colleagues or Board members is not aligned with the CEE.” In 2022, Meta banned employees from discussing “very disruptive” topics.

One employee posted “Why do critical comments of this announcement keep getting deleted?” 

“LOL my comment got CEE’d too. Good stuff,” a second posted. A third said “I think it’s particularly fascinating that none of the comments I have seen disappear contained any specifically prohibited content under the CEE and must have fallen under ‘disruptive content’ - and if any criticism of company decisions falls under the ‘disruptive content’ bucket, the future of the company is looking bleak.” 

Tracy Clayton, a Meta spokesperson, told 404 Media that no changes to the CEE have been made and stressed that some criticism has been left up. “There are also several comments that have expressed criticism that didn’t violate the CEE that remain up,” Clayton said. “Our CEE is very nuanced and it’s not a one-size-fits-all.”

The hypersensitive moderation of employees internally criticizing major public figures is particularly notable given that Tuesday morning, Mark Zuckerberg announced that Meta would get rid of many of its content moderation rules on its platforms. “It’s time to get back to our roots around free expression and giving people voice on our platforms. Here’s what we’re going to do,” Zuckerberg posted. “Replace fact-checkers with Community Notes, starting in the US. Simplify our content policies and remove restrictions on topics like immigration and gender that are out of touch with mainstream discourse.” Joel Kaplan, Meta’s new President of Global Affairs and the former Republican political operative who served in the George W. Bush administration, posted about the changes internally on Workplace, saying the policies were intended to foster “more speech and fewer mistakes.” 

One employee brought up this apparent disparity: “Given Zuck’s message this morning on decreasing content moderation on our platforms, is that also going to apply internally?” 

The rules for employees, the internal content moderator responded, are different than the rules for the public: “The CEE, which is focused on mitigating the potential for disruption and allowing us the space to work, ensuring a respectful work environment, and protecting company information, is different from our external content policies.”

“Curious to know if we can expect a similar shift to ‘more speech’ in internal Workplace posts/groups,” another employee asked. “CEE is quite chilling,” another said. “Basically any large scope critical post I make gets at least one message from ICR [Internal Community Relations].”

In a comment that has not yet been deleted, an employee posted “since my other comment was taken down, I’m just gonna let everyone know that I for one love my wife and daughter, and to top it off I also respect other people.”

“Our CEE has nothing to do with the announcements made today, internal and external moderation are separate, and I’ll repeat that it would be inaccurate to report that we’re loosening restrictions externally, while tightening internally,” Tracy Clayton, a Meta spokesperson, told 404 Media. “It’s important to note here that these comments were as you see there ‘flagged by the community for review.’ Further background our CEE is designed to help minimize disruption, so employees can focus and remain productive.”