Gravy Analytics Breach 2025: How a Misappropriated AWS Access Key Exposed a Location Data Broker

In January 2025, Unacast, the Norwegian parent company of US location data broker Gravy Analytics, confirmed that an unauthorised person had taken files from Gravy Analytics' Amazon Web Services (AWS) cloud storage environment. Its notification to Norway's data protection authority, Datatilsynet, published by the broadcaster NRK on 10 January 2025, says the company identified the access on 4 January 2025 and that the intruder appears to have got in through a "misappropriated access key". Unacast learned of the breach from the attacker, not from its own monitoring. It changed its AWS access keys, took its data processing platform offline and brought it back by 9 January. A hacker had already posted screenshots and a sample on a Russian-language cybercrime forum; researchers found more than 30 million location data points in the sample. Unacast has not said how the access key was obtained, how many people are affected or what data categories were taken. Its investigation was described as ongoing.

At a glance

What happened

Gravy Analytics collects and sells location data gathered from mobile devices, and says it tracks more than a billion devices daily, a figure TechCrunch notes is the company's own claim. It merged with Norway's Unacast in 2023. In the first days of January 2025, a hacker posted screenshots on a closed-access Russian-language cybercrime forum claiming to have stolen several terabytes of data from the company, including customer lists and smartphone location data. 404 Media first reported the post. The timing was awkward for the company: weeks earlier, the US Federal Trade Commission had banned Gravy Analytics and its subsidiary Venntel from collecting and selling Americans' sensitive location data without consent.

On 10 January 2025, NRK published a notification that Unacast's lawyers at BakerHostetler had sent to Datatilsynet, according to Reuters. The document says that on 4 January 2025, Gravy Analytics "identified unauthorized access to its AWS cloud storage environment", and that it became aware of the incident through communication from the unauthorised person. It says the person "appears to have gained access to the environment through a misappropriated access key" and obtained "some files". Whether those files contain personal data was still under investigation, but preliminary findings indicated they "could contain personal data", most likely relating to users of third-party services that supply data to Gravy Analytics. The notification says the company sent it for awareness because of speculation on social media and in the news.

The company's response, as described in the filing, was to secure its systems, change its AWS access keys, take its data processing platform offline and start an investigation with outside cybersecurity experts. Data processing services were running again by 9 January 2025. The notification also says the UK Information Commissioner's Office was being informed, and the ICO told TechCrunch it had "received a report from Gravy Analytics and are making enquiries". In an unattributed statement sent to TechCrunch on 12 January, Unacast said its "investigation remains ongoing". Unacast's executives did not respond to further questions from TechCrunch.

What Unacast has not said is as important as what it has. It has not explained how the access key was misappropriated: whether it leaked in code, was stolen from a device or another system, or belonged to an employee, a service or a partner. It has not said how long the attacker had access, how many people are affected or which data categories were taken. The hacker published a sample, and Baptiste Robert, chief executive of Predicta Lab, told TechCrunch it contained more than 30 million location data points, including devices at the White House, the Kremlin, Vatican City and military bases. App names in the data included Tinder, Grindr and FlightRadar, which told TechCrunch they had no direct relationship with Gravy Analytics. This page treats the claimed full size of the theft as unverified.

Timeline

How it happened: the identity attack path

1. Key obtained. The attacker came into possession of an AWS access key. Unacast describes the key as "misappropriated" but has not said how it was taken or whose key it was.
2. Cloud storage access. Using that key, the attacker reached Gravy Analytics' AWS cloud storage environment. The notification says network security tools, access controls and monitoring were in place, yet the key was apparently enough to read data.
3. Files taken. The attacker obtained files from the storage environment. The hacker claimed several terabytes; Unacast has confirmed only "some files".
4. Attacker makes contact. Gravy Analytics learned of the breach on 4 January 2025 through communication from the unauthorised person, and the hacker posted claims and a sample online.
5. Containment. The company changed its AWS access keys, took its data processing platform offline and restored service by 9 January 2025. How long the key had been in the attacker's hands is still under investigation.

Impact

• Confirmed by Unacast: unauthorised access to Gravy Analytics' AWS cloud storage and theft of files that could contain personal data, likely relating to users of third-party services that supply data to the company. Operations were briefly taken offline.
• Partly verified: a sample posted by the hacker held more than 30 million location data points, according to Predicta Lab. Experts told Reuters the leaked data appeared genuine.
• Claimed, not verified: several terabytes of data, including customer lists, industry information and location data on millions of smartphones.
• Undisclosed: how the key was obtained, how long access lasted, the number of affected people and the data categories involved.
• Potential: researchers quoted by TechCrunch showed how location points can be linked to individuals, including people who appear to be military personnel. These are demonstrations, not confirmed harms, but they show why location data is among the most sensitive data a breach can expose.

What this means for NHI governance

This incident is on an NHI list because the only access method the company has named is a machine credential. An AWS access key is a static secret: it does not expire unless someone rotates it, it carries no multi-factor prompt, and it works from anywhere unless policies restrict it. Whether the key was attached to a service, a pipeline or a person's programmatic access, it acted as a non-human identity, and possession of it was apparently enough to read a store of highly sensitive data.

The general lesson is that the blast radius of a credential is set by what it can reach, not by how it was lost. Organisations cannot always prevent a key from leaking, but they can make sure no single long-lived key can read an entire data lake, that keys are replaced by short-lived role credentials where possible, and that bulk reads from storage raise an alarm. Gravy Analytics found out from the attacker. Our AWS Access Keys Security Guide covers how to reduce and scope static keys, and the Cloud Access Key Leak Playbook sets out what to do in the first hours after a key is exposed.

The same pattern, a cloud secret leading straight to data, appears in the Pearson breach, disclosed later in 2025, and in the older Imperva breach, where a stolen AWS API key exposed customer data.

Recommendations

• Replace static access keys with short-lived credentials. Use IAM roles, workload identity federation and temporary credentials wherever possible, so a stolen key expires quickly. See our AWS Access Keys Security Guide.
• Scope every key to the least data it needs. No single key should be able to read an entire storage environment. Limit keys to specific buckets, prefixes and actions, and add network conditions. See our Least Privilege Techniques Guide.
• Alert on unusual bulk reads. Monitor storage access logs for large downloads, new source networks or access patterns that do not match the key's normal job, so you find out before the attacker tells you.
• Keep an owner and inventory for every key. Know which keys exist, who owns them, where they are stored and when they were last used and rotated. Remove unused keys.
• Rehearse key compromise response. Have a tested plan to revoke and rotate cloud keys quickly, review what they accessed and decide on regulator notification. See our Cloud Access Key Leak Playbook.
• Rotate on a schedule, not only after incidents. Regular rotation limits how long a quietly stolen key stays useful. See our Credential Rotation at Scale guide.

Frequently asked questions

How was Gravy Analytics hacked?

According to the notification Unacast sent to Norway's data protection authority, an unauthorised person appears to have accessed Gravy Analytics' AWS cloud storage environment through a "misappropriated access key" and obtained some files. Unacast has not disclosed how the key was obtained, whose key it was or how long the attacker had access.

What data was exposed in the Gravy Analytics breach?

Unacast said the files could contain personal data, likely relating to users of third-party services that supply data to Gravy Analytics, but had not confirmed specific categories. A sample published by the hacker contained more than 30 million location data points, according to researcher Baptiste Robert. The hacker's claim of several terabytes covering millions of phones has not been verified.

When was the Gravy Analytics breach disclosed?

Gravy Analytics identified the access on 4 January 2025. Claims had appeared on a cybercrime forum the week before, and the breach was publicly confirmed on 10 January 2025, when NRK published Unacast's notification to Datatilsynet. Unacast also notified the UK ICO.

Related NHI Mgmt Group resources

Imperva breach 2019 · Pearson breach 2025 · Football Australia AWS keys exposure · AWS Access Keys Security Guide · Cloud Access Key Leak Playbook

How NHI Mgmt Group can help

The Gravy Analytics breach shows how much can rest on a single cloud access key, and how hard it is to answer basic questions afterwards when key ownership and use are not tracked. NHI Mgmt Group helps organisations build an inventory of cloud keys and other machine identities, set ownership and rotation rules, replace static keys with short-lived credentials and spot misuse early. Our training uses real cases like this one to make those controls practical. See our NHI and AI agent security training.

References

• Datatilsynet (via NRK): Gravy Analytics and Unacast security incident notification, redacted (10 January 2025)
• Reuters via ThePrint: Location tracking company Unacast tells Norway its data was hacked, broadcaster says (11 January 2025)
• TechCrunch: A breach of Gravy Analytics' huge trove of location data threatens the privacy of millions (13 January 2025)
• Biometric Update: Breach exposes privacy risk from de-anonymization of location data (15 January 2025)