Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / The Hidden Danger of Data Brokers in Cybersecurity
Transcript
- Lucas: Luna, when we talk about cybersecurity, we usually focus on the big names — the CrowdStrikes, the Palo Altos, the ransomware gangs. But there's a whole class of companies that security teams often overlook, and they hold more sensitive data than almost anyone else. I'm talking about data brokers. Luna: Right — the companies that collect, aggregate, and sell personal information. They're like the shadow infrastructure of the internet. Lucas: Exactly. And the problem is, if a data broker gets breached, it's not just one company's data that leaks — it's hundreds of millions of records that can be used to target employees, executives, and even infiltrate corporate networks. Luna: So it's a supply chain risk, but one that most companies don't even realize they're exposed to because they're not the ones directly sharing data with the broker. Their employees' data is being collected from other sources. Lucas: Precisely. Take the 2023 breach at a company called National Public Data, which collects background check information. They had a breach that exposed Social Security numbers, addresses, and other personal details for potentially hundreds of millions of people. That's not a theoretical risk — that's real. Luna: And that data can be used for very targeted phishing attacks, even social engineering against high-level executives. It's like giving attackers a cheat sheet. Lucas: Right. So the question becomes: what can security teams actually do about this? Because you can't opt out of every data broker — there are thousands of them, and many operate in legal gray areas. Luna: But you can audit your exposure. A lot of companies are now doing data broker scans as part of their third-party risk assessments. There are tools that can identify which brokers have your employees' data and request removal. Lucas: It's becoming a standard part of security hygiene, especially for high-risk roles like C-suite and IT staff. The other angle is regulation. The FTC has been increasingly active on data broker practices, and several states have laws like the California Consumer Privacy Act that give individuals more control. Luna: But enforcement is still inconsistent. And data brokers often argue they're just repackaging public information. Lucas: Which is technically true, but the aggregation itself creates a new risk. There's a difference between a public record existing somewhere and a broker making it searchable alongside credit scores and purchasing history. Luna: So what's the business side of this? How do these brokers make money, and why is it so hard to rein them in? Lucas: The business model is pretty straightforward: they collect data from public records, credit bureaus, loyalty programs, social media scraping, and then sell access to marketers, insurers, employers, and background check companies. The revenue can be enormous — one of the largest, Acxiom, reportedly pulls in over a billion dollars a year. Luna: And their customers include Fortune 500 companies, so there's a built-in demand. But if a broker is breached, those same companies are exposed. Lucas: That's the paradox. The same data that helps a company target the right customers can also be used to craft a perfect spear-phishing email against their CEO. So security teams are starting to push back — asking their marketing departments to limit data sharing with third-party brokers. Luna: I've heard of some companies implementing 'data minimization' policies — only sharing what's absolutely necessary for business operations. Lucas: Yeah, it's a shift from the mindset that more data is always better. And it's not just about breach risk — regulators are starting to penalize companies for lax data-sharing practices. The FTC has settled cases against data brokers for failing to protect consumer data. Luna: And there's pending regulation in Europe — the Data Act is pushing for more transparency around data sharing. Lucas: But regulation moves slowly, and the landscape changes fast. One thing security teams can do right now is run a 'data broker footprint' for their organization. Identify which brokers hold employee data, assess the security practices of those brokers, and request removal where possible. Luna: That sounds like a practical first step. And it's relatively low cost compared to a breach. Lucas: Exactly. And look, if these conversations are useful for what you're building or running, we hope you'll consider supporting the show. It's listener support that keeps us ad-free and independent. You can do that at buy me a coffee dot com slash fexingo. Luna: Absolutely. Every bit helps us keep bringing these deep dives. Now, back to data brokers — one of the most troubling aspects is that many brokers don't even have basic security controls in place. Lucas: Right. A 2024 investigation by KrebsOnSecurity found that several small data brokers had exposed databases with no password protection. Just sitting on the open internet. That's not sophisticated hacking — that's negligence. Luna: And yet those brokers keep operating because the demand for data is so high. It's a classic market failure where the cost of insecurity is externalized. Lucas: Until a breach happens, and then the cost lands on the companies whose employees' data was leaked. That's why some larger enterprises are now making it a contractual requirement that any data broker they work with must have a certain level of security certification. Luna: So basically, using purchasing power to force better practices. Lucas: Exactly. And it's working in some sectors. Insurance companies, for example, are starting to ask their data vendors for SOC 2 reports and penetration testing results. Luna: What about the employees themselves? Can individuals do anything to reduce their own exposure? Lucas: There are services that help you opt out of data brokers, but it's a manual process — some brokers make it deliberately difficult. The most effective approach tends to be corporate-level action, where the company's legal team sends takedown requests on behalf of key personnel. Luna: So it's not a problem individuals can solve alone. It requires institutional pressure. Lucas: Right. And that's why this is such an interesting intersection of cybersecurity, business strategy, and regulation. It's not just a technical fix — it's about changing how companies value and share data. Luna: Which is a much bigger conversation than just patching a server. Lucas: Exactly. And as we move into 2026, I think we'll see more companies treating data broker risk as a core part of their cybersecurity framework, not just an afterthought.