Celebrities' Stolen Data Worth More Than Gold

Every now and then, there is news of hackers breaking into databases and plundering the sensitive information of hundreds of millions of people. While the personal and financial information of regular citizens is valuable, it is gold dust compared to stolen celebrities’ data. 

Turning the stolen data of millions of people into money is not only long but also problematic and not always worth it. For instance, cybercriminals first have to load the stolen digital data into physical cards, create a system that eludes fraud detection when using the card. The initial plunderers do not always have the resources to do this on their own, so they have to sell the stolen data to other cybercriminals. 

Accounting for bad data, the retail price for stolen data in the criminal ecosystem is cheap as buyers have to sort spilth. Eventually, only a handful of useful data remain—and the information obtained can only be used once to avoid leaving a trail for law enforcement. The spilth, consisting of biodata, usernames, emails, and other non-incriminating consumer data, are sold in bulk and cheaply to data brokers through backdoor transactions. Now off the black market, data brokers mix the stolen data with legally purchased, albeit pricier, data purchased from service providers who mine data from user apps and software. Then, they sell it to anyone in the business of targeted marketing and advertising. There are also people search sites, such as Search Quarry, Rehold, Peek You, that use deep learning algorithms to compile data from the internet. 

On the other hand, compared to the stolen data of millions of people, stolen celebrities data are Fricot nuggets. Cybercriminals have found ways to melt these nuggets for money. Leaking a celebrity’s sensitive data will indeed cause a ruckus, but only for a while. After all, data removal services and online reputation managers, such as DeleteRecords, are very efficient at what they do. So, cybercriminals typically resort to blackmail—since it is cheaper to buy back your stolen data when you consider the damage to reputation and inconveniences. 

When blackmail doesn’t work, cybercriminals leverage their ill-gotten sensitive data to access celebrities’ social media accounts and scam fans. The June 2020 Twitter hack—which affected over 130 high-profile accounts, from Elon Musk to Bill Gates and resulted in the loss of over $121,000—is still fresh in memory.  

Meanwhile, for the companies that suffer these data breaches, cybersecurity is not just an external hacker affair. It has also been caused by employees’ careless handling of sensitive information, resulting in lawsuits and losing clients’ trust. 

Stephanie Hoffman recently sued her law firm after it allegedly failed to protect her personal data in a court filing. The law firm’s negligence had made her social security number, passport details, and contact information publicly available in court records. Consequently, anyone can request copies of the documents containing that information, and the record custodian would be legally obliged to provide them under New York’s Freedom of Information Law. Similarly, Michael Jacksons’ medical records, records of Farrah Fawcett’s cancer diagnosis, and Jason Pierre-Paul’s hand injury reports were also reportedly leaked by hospital staff in data breaches.  

The bottom line is that everyone is a potential victim in a data breach. Also, the blowback can be severe for everyone involved. Publicizing a person’s private information can quickly ruin their finances, derail their careers, and damage their reputations. The solution? Damage control must begin as quickly as hackers throw the guano at the whirling blades. 

Damage control involves changing account passwords and contacting the social media platform admins to pull down the leaked pictures or videos. And when push comes to shove, taking legal actions against a digital platform that refuses to destroy the stolen data, involving law enforcement, regulators, or using online reputation managers. 

However, the cheaper option is to prevent this breach from happening in the first place. Using a PO box protects your house address during leaks; a burner phone dissociates your identity from a device. And above all, vetting a company’s cybersecurity measures before entrusting your sensitive data in their care or switching service providers.