KUALA LUMPUR: A database containing more than 7.6 million Waze user records is being advertised for sale on a dark web marketplace by cybercriminals, according to a report.
The report, published by cybersecurity technology firm ClearPhish, said the database allegedly contains sensitive information on Waze users, including usernames, unique user identifiers (unique IDs), global positioning system (GPS) location data and travel history.
"The data is being advertised for sale on a dark web marketplace by the seller, a cybercriminal who stole the information.
"The data leak is concerning as it could increase the risk of security threats to users of the application.
"If the data is proven authentic, the information could potentially be exploited for various malicious purposes, including stalking individuals, identifying travel routines and planning targeted attacks," the report said.
It added that this was not the first time Waze had come under scrutiny over cybersecurity.
Cybersecurity researcher Peter Gasper had previously identified weaknesses in the application programming interface (API) that could be exploited to track users' movements in real time.
"Although Google has reportedly fixed some of the weaknesses, the latest allegations raise questions over whether Waze still has significant security weaknesses.
"The ability to access real-time GPS data and unique IDs raises serious concerns, as the information could potentially allow cybercriminals to track users' movements, monitor travel patterns or impersonate certain individuals for malicious purposes," he said.
Waze has since denied that its navigation application poses a security risk, following the government's directive barring civil servants from using it.
© New Straits Times Press (M) Bhd