KUALA LUMPUR: A threat actor has allegedly offered a database containing personal information and real-time GPS location records of nearly 7.7 million Waze users for sale on a dark web marketplace, according to cybersecurity firm ClearPhish.
The database was reportedly advertised as containing confidential information belonging to users of Waze, Google’s navigation application.
The allegedly leaked data includes usernames, unique user identification numbers, travel histories and real-time GPS coordinates.
In a report published in February 2025, ClearPhish warned that such a leak could allow attackers to track users’ movements in real time, potentially exposing them to cyberstalking, identity theft and other security threats.
The report also cited previous concerns over Waze’s data security. Cybersecurity researcher Peter Gasper had earlier identified an application programming interface (API) vulnerability that could potentially be exploited to track users’ movements in real time.
Although Google was reported to have addressed some of the vulnerabilities, ClearPhish said the latest allegations raised further questions about the application’s security.
Access to real-time GPS data and unique user identifiers could enable cybercriminals to monitor travel patterns, impersonate individuals or exploit location information for malicious purposes.
ClearPhish also warned that the alleged breach could pose privacy risks to users worldwide, including cyberstalking, identity theft, phishing and the manipulation of navigation services. Questions were also raised over whether other user-generated information, such as route preferences and shared reports, might have been affected.
Google has yet to officially confirm the alleged data breach, according to the report.
Users were advised to update their account passwords, disable location tracking when the application is not in use, watch for suspicious login activity and phishing attempts, and consider using a virtual private network (VPN) for additional data protection.
The incident highlights growing concerns over the privacy risks associated with location-based applications. However, the alleged breach and the extent of any data exposure remain unconfirmed.
Separately, the Malaysian government yesterday decided to prohibit civil servants from using Waze to protect government information and users’ personal data from potential misuse by the Israeli regime.
Prime Minister Datuk Seri Anwar Ibrahim said the decision took into account Waze Mobile Ltd’s status as a data controller incorporated and operating under Israeli law.
Anwar also encouraged the public to consider using the locally developed TuJu navigation application, developed by the Malaysian Highway Authority (LLM), as an alternative.
-AWANI
