Cybersecurity researcher Sam Jadali uncovered DataSpii, a leak that compromised the browsing data of as many as 4 million Chrome and Firefox users through at least eight extensions: Hover Zoom, SpeakIt!, SuperZoom, SaveFrom.net Helper, FairShare Unlock, PanelMeasurement, Branded Surveys, and Panel Community Surveys. According to the source, the extensions transmitted information users had not consented to share, including medical records, tax returns, GPS locations, travel itineraries, usernames, passwords, credit-card data, genetic profiles, API keys, proprietary source code, and internal corporate network details.
The exposed material was made available through Nacho Analytics, a marketing-intelligence company that advertised itself as “god mode for the internet.” Paid and trial subscribers could access the leaked information through a Google Analytics account, allowing searches of individual domains and near-real-time visibility into work at thousands of companies. Reported affected organizations included the Pentagon, Walmart, AT&T, Bank of America, Apple, Microsoft, Amazon, Boeing, Tesla, SpaceX, Pfizer, and major cybersecurity firms. Jadali worked with Ars Technica and The Washington Post to interview affected users and companies; the source describes the disclosures as a major privacy and security failure, but does not identify a final court judgment or comprehensive regulatory penalty.
