Not surprised though.

archive.ph/yJgue

They also share personal, location, and motion data with third-party advertisers as well as driving analytics services.

We may disclose your personal information to our vendors and consultants who help us provide our Services or who perform services on our behalf, such as accounting, managerial, technical, email or chat services, marketing or analytic services, fraud prevention, bot detection, web hosting, and to other third-party partners or Service Providers to provide services or features to our members on our behalf or on behalf of our permitted business partners.

We may disclose personal information, including contact information and location and movement data, mobile device information (such as information generated by the gyroscope and accelerometer in your device), application analytics (including IP address and device identifiers), technical and analytical data, and driving event data with third-party partners that provide certain features and services you elect to use through or in connection with our Products or Service, to the extent that they are available in your country or region of residence. Some examples are as follows:

Crash Detection and Emergency Dispatch Services; Roadside assistance; Identity theft protection; and Driving analytics services.

…zendesk.com/…/16038777217175-Life360-Privacy-Pol…

thats probably a helluva list, easier to list corpos who are NOT doing it instead.

Yes. They all do.

Apple cannot sell your AirTag data, because they don’t know it. It’s all encrypted.

I’m sure they do, likely have their own internal security team as well as contract security work out. The purpose of hiring hackers isn’t to make the company unhackable, it’s to make it harder, more time consuming and costly to hack the company.

I’m not OP but running it through Wayback Machine worked for me: web.archive.org/…/hacker-accesses-internal-tile-t…

If not here’s the text of the article (but the link has a bunch of images too that might be useful):

A hacker has gained access to internal tools used by the location tracking company Tile, including one that processes location data requests for law enforcement, and stolen a large amount of customer data, such as their names, physical addresses, email addresses, and phone numbers, according to samples of the data and screenshots of the tools obtained by 404 Media.

The stolen data itself does not include the location of Tile devices, which are small pieces of hardware users attach to their keys or other items to monitor remotely. But it is still a significant breach that shows how tools intended for internal use by company workers can be accessed and then leveraged by hackers to collect sensitive data en masse. It also shows that this type of company, one which tracks peoples’ locations, can become a target for hackers.

“Basically I had access to everything,” the hacker told 404 Media in an online chat. The hacker says they also demanded payment from Tile but did not receive a response.

Tile sells various tracking devices which can be located through Tile’s accompanying app. Life360, another location data focused company, acquired Tile in November 2021.

The hacker says they obtained login credentials for a Tile system that they believe belonged to a former Tile employee. One tool specifically says it can be used to “initiate data access, location, or law enforcement requests.” Users can then lookup Tile customers by their phone number or another identifier, according to a screenshot of the tool.

A drop down menu which is selected in the screenshot tells users to select a request type: “DATA_ACCESS,” “LOCATION_HISTORY,” and “LAW_ENFORCEMENT.”

Hackers in recent years have repeatedly targeted tools used by tech companies to provide data to law enforcement or ones that are otherwise used by the company’s own staff to manage and access data. Sometimes, the hackers gain access to the tool itself, like when one used an internal Twitter system to take over accounts. In another case, a fraudster bribed an insider at Roblox to use that company’s tools for malicious purposes. Some hackers have even taken to installing malware inside U.S. telecoms so they can remotely control internal employee tools themselves.

Hackers also compromise email accounts used by police or other government officials, and then use those to demand sensitive data from tech companies and platforms by posing as the respective law enforcement officer. Targeted companies include Facebook, TikTok, and Apple.

Some of the other internal tools the hacker provided screenshots of include those for transferring Tile ownership from one email address to another; one for creating administrative users; and one for sending a push notification to Tile users. The hacker says they decided not to use this capability.

The hacker says they then accessed another system used by Tile which contained the customer data. The samples the hacker gave to 404 Media included names, addresses, phone numbers, as well as order and returns information and details on the payment method used.

From here, the hacker said they scraped the data. “I was able to enumerate through customer ids. Sent millions of requests to scrape the data.”

404 Media verified the data by randomly selecting a series of email addresses from the data, and then using them to create new accounts on Tile’s website. In most cases this was not possible because the email address was already in use by an existing customer. 404 Media also contacted multiple people inside the data via email.

“Yep, that would be me,” one person said when 404 Media sent all of the data related to their account.

Tile told 404 Media in a statement “Recently, an extortionist contacted us, claiming to have used compromised Tile admin credentials to access a Tile system and customer data. We promptly initiated an investigation into the potential incident. Our investigation detected that certain admin credentials were used by an unauthorized party to access a Tile customer support platform, but not our Tile service platform. The Tile customer support platform contains l

There’s a few 3rd party solutions that are compatible with Google’s find my device coming out this year. Pebblebee just released a few trackers, and iirc chipolo is working on one too.