KUALA LUMPUR, Oct 22 — A threat actor has claimed to be selling a massive dataset containing the personal details and real-time Global Positioning System (GPS) records of nearly 7.7 million Waze users on a dark web marketplace, cybersecurity firm ClearPhish said.
In a report published in February last year, it cited reports stating that the data was advertised for sale on a dark web marketplace, where the seller claimed it contained sensitive user information from Waze, a Google-owned navigation app.
The leaked records allegedly included usernames, unique user identification numbers, travel history, and real-time GPS locations.
“The breach is particularly concerning as it could allow attackers to track users in real time, exposing them to security threats such as stalking, targeted attacks, or identity theft,” ClearPhish said.
It added that this was not the first time the navigation service had faced scrutiny over data security, as cybersecurity researcher Peter Gasper had previously uncovered Application Programming Interface vulnerabilities that could be exploited to track user movements in real time.
“While Google has reportedly patched some of these vulnerabilities, the latest claims suggest that Waze may still have major security flaws,” ClearPhish said.
The firm warned that access to GPS data and unique user identifiers could allow cybercriminals to monitor movements, identify travel patterns, and impersonate individuals for malicious purposes.
“Given Waze’s reliance on crowdsourced data, the leak also raises concerns about whether other types of user-generated content (such as route preferences and shared reports) have been compromised,” it said.
A confirmed breach could have serious privacy implications and potentially expose Waze and Google to legal and regulatory consequences.
At the time of the report, Google had not officially confirmed the alleged breach.
Nevertheless, ClearPhish said that cybersecurity experts advised Waze users to take immediate precautions to safeguard their personal data.
If the breach is verified, users should update their account passwords immediately, disable background location tracking on their mobile devices when the app is not in use, remain vigilant against phishing emails or unusual login attempts, and consider using virtual private networks for enhanced data protection.
Users were also encouraged to review the app's data-sharing permissions and follow official updates.
The allegations have resurfaced amid the Malaysian government's decision yesterday to ban civil servants from using Waze, citing concerns over the potential misuse of government information and personal data by the Israeli regime.
Prime Minister Datuk Seri Anwar Ibrahim said the decision took into account Waze Mobile Ltd’s status as a data controller for users, with the company incorporated and operating under Israeli law.
As an alternative, Prime Minister Datuk Seri Anwar Ibrahim had encouraged the public to use TuJu, a local navigation app developed by the Malaysian Highway Authority.
