A massive leak data was discovered by security researcher Sam Jidali and his team. The leak came from 8 different Chrome and Firefox.
The result of this leak was the exposure of personal data of about 4 million people and information from 45 major companies. The personal information ended up in a service called Nacho Analytics. The researchers named the Chrome and Firefox extensions in question, “DataSpii”.
What kind of data was leaked?
According to researchers, the extensions collected and exposed browsing data, such as URLs, which revealed users' personal information and a large catalog of data from major companies, such as Apple, Walmart, Amazon, 23AndMe, SpaceX, Skype, etc.
Among the sensitive personal data collected by the DataSpii extensions were: tax returns, GPS locations, cloud services and data, file attachments, credit card details, genetic profiles, online shopping history, and medical records.
The corporate data collected by the extensions includes real-time employee activity, the structure of the private LAN network, links embedded in a LAN website, API keys, source code, passwords, and zero-day vulnerabilities.
What are the extensions that stole the data?
Chrome and Firefox users were the most affected by this leak, but users risk of other Chromium-based browsers, such as Opera, may also have been at.
The extensions that stole users' data are the following:
- Branded Surveys (Chrome)
- FairShare Unlock (Chrome and Firefox)
- HoverZoom (Chrome)
- Panel Community Surveys (Chrome)
- PanelMeasurement (Chrome)
- net Helper (Firefox)
- SpeakIt! (Chrome)
- SuperZoom (Chrome and Firefox)
What measures did Google and Mozilla take?
When the leak became known, Google and Mozilla removed or disabled the extensions from users' browsers. Additionally, they are no longer available for download.
In case you still see the above extensions in browser , you can remove them yourself "manually".
