Data Broker Hack Reveals Supply Chain Risks in Advertising

In early 2025, it was revealed that hackers successfully stole location data from millions of users by breaching a data broker that collects location data from thousands of apps via advertising networks and real-time bidding systems. This data, originating from apps like Candy Crush, Tinder, and many others, was exfiltrated and posted online.

For companies that programmatically purchase ad space, this incident illustrates the inherent complexity of the mobile data and ad tech supply chain and how vulnerable this chain can be to cyber incidents.

How Location Data Enters the Advertising Supply Chain

Many free apps generate revenue through advertisements. To do this, user data, such as behavior, demographics, and location, is collected and passed within a network of technology partners, including advertising networks, data sellers, and real-time bidding platforms. This data is used to make ads more relevant and optimize campaigns.

Important for ad buyers:

• The data you use to target bids often does not come directly from the app developer, but through third parties in the advertising supply chain.
• This chain consists of technology providers, DSPs (Demand-Side Platforms), SSPs (Supply-Side Platforms), data brokers, and networks that distribute and trade real-time data.

If one party in this chain is compromised, such as a data broker, it can introduce risks for everyone who relies on that data for advertising purposes.

Supply Chain Risks for Ad Buyers

Unknown Data Flows
Much of the location data being sold is not transparently collected by the app developers themselves, but through advertising ecosystems without their or the end-users' awareness. If these ecosystems are hacked, all involved data is exposed.

Reputational Risk from Indirect Involvement
When a data supplier or ad tech partner experiences a breach, the data that ad buyers use may contain sensitive information that reveals more than intended. Location data, for example, can track where people live, work, or which healthcare facilities they visit—information that users consider private.

Regulatory and Compliance Risks
In the European context, strict privacy regulations such as the GDPR apply. Even if a company nominally complies with data suppliers, a data leak or unauthorized data collection by an external partner can cause compliance issues, such as fines or sanctions due to a lack of control over third parties.

For Advertisers and Buyers: Lessons from the Hack

1. Map Your Data Supply Chain
Ensure you know which partners are involved in collecting, processing, and delivering the data you use for your programmatic campaigns. This helps to identify risks before they lead to problems.

2. Demand Transparency from Data Suppliers
Ask partners for clear information on how and from where data is collected, and how they ensure security and compliance. Not all data in real-time bidding system chains is equal; differences in sources mean differences in risk.

3. Actively Monitor Your Suppliers
Cyber incidents at a data partner can directly affect your campaigns and audience data. Active monitoring and audits are part of good risk management.

Conclusion

The recent hack of a data broker, which stole location data from users of popular apps, demonstrates how supply chain risks can run deep within the digital advertising chain, often in places where buyers themselves have little visibility. For companies that programmatically purchase ad space, this means that effective risk analysis must go beyond the DSP, SSP, or data provider you work with directly. You need to understand and secure the entire chain.

Supply chain risks not only affect people's privacy but can also harm your ad efficiency, compliance, and reputation if you rely on data circulating through these complex ecosystems.