Technology
10 signs your personal data is being sold online
NEWYou can now listen to Fox News articles!
Your personal data is probably being sold right now. Scam calls, junk emails, and weird login alerts aren’t random. They’re warning signs that your information is being circulated through data brokers, often without your knowledge or consent.
Major breaches, like the recent Adidas hack, have exposed millions of names, emails, phone numbers, and home addresses. Once this data is leaked, it’s fed into a vast marketplace of data brokers who package, sell, and resell your information to advertisers, spammers, scammers and even cybercriminals.
Think it hasn’t happened to you? Here are 10 red flags that your data is already out there and the steps you can take to stop it from spreading further.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Illustration of a woman’s personal data being exposed (Kurt “CyberGuy” Knutsson)
Be proactive about your privacy
If your personal information appears on people-finder sites or in sketchy online databases, it stays there until you remove it. This means your full name, home address, email, and phone number are available to anyone, including scammers and stalkers. You can manually opt out of each site, but that takes time and patience. Instead, consider an automated privacy service that scans data broker sites and sends removal requests on your behalf. The less data floating around, the less likely it is to be misused.
11 EASY WAYS TO PROTECT YOUR ONLINE PRIVACY IN 2025
Illustration of personal data available online (Kurt “CyberGuy” Knutsson)
OVER 8M PATIENT RECORDS LEAKED IN HEALTHCARE DATA BREACH
10 signs your data is being bought and sold
If any of these are happening to you, your data is likely already floating around the broker and scammer economy. Here’s what to watch for:
1. You’re suddenly flooded with spam emails
If your inbox is overflowing with shady product offers, sketchy promotions, or strange marketing emails you never signed up for, it’s a good bet your email address has been sold. This kind of spam typically results from your address being added to mass marketing lists purchased in bulk.
2. You’re getting nonstop scam calls
More calls than usual from unknown numbers? Telemarketers, fake IRS agents, and car warranty scammers often use brokered phone lists. If you’re getting several calls a day, it likely means your number is being recycled by different call centers and fraud operations.
3. You receive password-reset emails you didn’t request
Unfamiliar password-reset prompts are a sign someone is attempting to access your account. They may have found your email address and other leaked credentials and are now probing for weak points. It’s a key signal that your digital footprint is being exploited.
4. You notice strange charges on your bank account
Tiny charges can be a test by cybercriminals to see if stolen card info works. If even one unrecognized charge shows up, it’s critical to act fast. These small transactions often lead to bigger, more damaging fraud if ignored.
5. You’re locked out of your own accounts
Losing access to your email, bank, or social media accounts may mean hackers have already reset your passwords. With enough personal data, criminals can bypass security questions and fully take over your identity online.
WHAT IS ARTIFICIAL INTELLIGENCE (AI)?
6. Friends say they got weird messages from you
If your contacts report strange DMs, fake money requests, or odd links coming from your accounts, that’s a strong sign someone else has gained access. Cybercriminals use this tactic to trick your friends into clicking dangerous links or handing over money.
7. Sketchy social media accounts start following you
A wave of fake profiles suddenly following or messaging you is more than annoying; it could be a coordinated attempt to gather more information about you or impersonate you later. These accounts may also be bots programmed to phish for details or direct you to scam pages.
8. Personal info is already filled in on new websites
If your name, email, or phone number shows up on a form before you even touch the keyboard, that website may have purchased your information. Some sites share consumer data with partners, and this pre-fill behavior can indicate that your data is being sold and shared.
9. You find your profile on people-search websites
Sites like Spokeo or Whitepages can display your full name, home address, phone number, family members, and more often scraped from public records or sold by data brokers. This makes you a target for identity theft, scams, and unwanted contact.
10. You’re denied credit or insurance for unclear reasons
Rejections for loans, insurance, or rental applications can stem from inaccurate or outdated data in broker databases. If your reputation or credit score is being shaped by information you didn’t even know existed, that’s a clear signal that your data is out of your hands.
A woman working on her laptop (Kurt “CyberGuy” Knutsson)
CUSTOM DATA REMOVAL: WHY IT MATTERS FOR PERSONAL INFO ONLINE
How to stay safe: Steps to protect your data now
Noticing just a few of these signs means it’s time to take action. The more proactive you are, the better you can limit future damage and prevent your data from spreading further.
1. Invest in a personal data removal service: Personal data removal services can request that your information be taken down from hundreds of data broker sites. It’s an effective way to remove your name from public listings and stop new profiles from popping up. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you. Check out my top picks for data removal services here.
Get a free scan to find out if your personal information is already out on the web.
2. Strengthen your passwords: Use long, unique passwords that are different for every account. Consider using a password manager to generate and store complex passwords. Get more details about my best expert-reviewed password managers of 2025 here.
3. Turn on two-factor authentication: Adding a second step to your login process, like a text code or app confirmation, can stop hackers even if they know your password. Turn this on for email, banking, and any service that stores your sensitive info.
4. Monitor your financial accounts regularly: Check your bank and credit card statements every few days. Set up alerts for any activity, and if you’re not actively applying for credit, consider freezing your credit reports with all three bureaus.
5. Use alias email addresses: Create separate email addresses for things like online shopping, sign-ups, and banking. This helps keep your primary inbox private and makes it easier to trace which services may be leaking or selling your information. If one alias starts receiving junk mail or suspicious messages, you can simply delete it without affecting your main account. It’s one of the simplest ways to reduce spam and protect your digital identity. See my review of the best secure and private email services here.
6. Don’t click suspicious links or attachments, and use strong antivirus software: Phishing attempts often look convincing, especially if scammers already know your name or other details. If something feels off, delete the message and go directly to the website instead of clicking the link. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.
7. Be cautious about what you post publicly: Avoid sharing your birthday, hometown, full name, or photos of your home or license plates. Social media platforms are heavily scraped by bots and bad actors looking to compile detailed profiles.
8. Block robocalls and filter scam numbers: A surge in robocalls is a strong sign your phone number is being sold or shared by data brokers. These calls often come from spoofed or international numbers and may include fake IRS agents, tech support scams, or phony insurance offers. To fight back, enable your phone carrier’s spam call protection (AT&T ActiveArmor, Verizon Call Filter, or T-Mobile Scam Shield). You can also use third-party apps like RoboKiller, Hiya, or Truecaller to screen calls, block known scam numbers, and report suspicious callers. Be sure to avoid answering unknown calls, even pressing a button to “opt out” can confirm your number is active and lead to more spam. Check out how to get rid of robocalls with apps and data removal services.
WHAT HACKERS CAN LEARN ABOUT YOU FROM A DATA BROKER FILE
Kurt’s key takeaways
Your personal data is valuable, and once it’s out there, it’s difficult, sometimes impossible, to claw it back. But you’re not powerless. The more proactive you are, the safer you’ll be. Start by cleaning up your digital footprint and removing your information from people finder and data broker sites. Whether you go manual or use a trusted service, acting now can help you avoid bigger problems later. Protect your privacy, defend your accounts, and stay one step ahead of the scammers.
Should data brokers be required to get your permission before collecting and selling your personal information? Let us know by writing to us at Cyberguy.com/Contact.
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you’d like us to cover.
Follow Kurt on his social channels:
Answers to the most-asked CyberGuy questions:
New from Kurt:
Copyright 2025 CyberGuy.com. All rights reserved.
SpaceX and Cursor are now working closely together to create the world’s best coding and knowledge work AI.
The combination of Cursor’s leading product and distribution to expert software engineers with SpaceX’s million H100 equivalent Colossus training supercomputer will allow us to build the world’s most useful models.
Cursor has also given SpaceX the right to acquire Cursor later this year for $60 billion or pay $10 billion for our work together.
NEWYou can now listen to Fox News articles!
If you’ve ever clicked “Check for updates” and trusted what you saw, you’re not alone. That’s exactly what this latest scam is counting on.
The page mimics official branding, includes a believable knowledge base number and presents a big blue download button that feels familiar.
The catch? The download installs malware designed to steal passwords, payment details and account access.
According to researchers at Malwarebytes Labs, a cybersecurity research and threat intelligence team inside Malwarebytes, the site uses a typosquatted domain that looks close enough to a real Microsoft URL to fool a quick glance. That small trick is often all it takes.
APPLE APP PASSWORD SCAM EMAIL WARNING
Cybersecurity researchers warn a fake Microsoft update site uses a look-alike URL and a familiar download button to deliver data-stealing malware. (Michael Nagle/Bloomberg via Getty Images)
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Why this fake Windows update malware slips past detection
At first glance, nothing seems off. The file looks like a standard Windows installer. It even lists “Microsoft” in its properties. That’s where this attack gets clever. Instead of using obvious malicious code, the attackers built the installer with legitimate tools and layered the attack in stages. Each piece looks harmless on its own.
Here’s what’s happening behind the scenes:
- The installer launches what appears to be a normal app
- That app quietly runs hidden scripts
- A disguised process loads a full Python environment
- Data theft tools activate in the background
Because each step looks routine, many security tools fail to flag it right away. Researchers also noted that antivirus engines initially showed zero detections for key parts of the attack. That does not mean the file is safe. It means the malicious behavior is well hidden.
What this fake Windows update malware is stealing
Once installed, the malware gets to work fast. It collects details about the infected device, including location and IP address. Then it reaches out to remote servers to receive instructions and upload stolen data.
The targets include:
- Saved browser passwords
- Login sessions and cookies
- Payment details
- Discord account tokens
It even tries to shut down other processes on your system to avoid interference while it works. In some cases, it modifies apps like Discord to intercept account activity in real time.
How the fake Windows update malware stays on your system
This malware is designed to stick around. It creates entries that look like normal system processes, so they blend in. One registry entry mimics Windows Security Health, which most users would ignore. It also drops a shortcut in your startup folder with a familiar name like Spotify. That makes it easy to overlook. Two different persistence tricks mean it can survive a reboot and keep running.
FAKE WINDOWS UPDATE PUSHES MALWARE IN NEW CLICKFIX ATTACK
A fake Windows update page is tricking users into downloading malware that steals passwords, payment details and account access. (Beata Zawrzel/NurPhoto)
Why this fake Windows update scam feels so real
There’s a bigger trend behind this. Researchers say campaigns like this often target regions where large data breaches have already exposed personal information. When attackers already know your name, provider or habits, they can build scams that feel tailored to you. That makes a fake Windows update page far more believable than a generic phishing email.
It also highlights something important. Today’s malware often hides inside legitimate tools and trusted frameworks. That makes it harder to detect and easier to trust. This campaign shows how far scammers have come. They are no longer relying on sloppy emails or obvious fake links. Instead, they are building layered attacks that look and behave like trusted software.
Even experienced users can get caught off guard when everything appears normal. The biggest takeaway is simple. A clean scan result or a familiar interface does not guarantee safety.
Microsoft says it’s aware of the threat
Microsoft confirmed it is tracking this type of activity and urges users to be cautious when downloading updates from unfamiliar sources.
“We are aware of reports of fraudulent websites impersonating Microsoft, and we actively work to detect and disrupt malicious activity across the internet,” A Microsoft spokesperson told CyberGuy. “We encourage customers to be cautious of unexpected prompts or downloads and to verify that they are interacting with legitimate Microsoft domains. As a best practice, we recommend users verify the legitimacy of a link by going directly to our website from your own saved favorite, from a web search, or by typing the domain name yourself.”
For more guidance on how to protect against online phishing scams, you can refer to Microsoft’s official support page at support.microsoft.com.
MICROSOFT CROSSES PRIVACY LINE FEW EXPECTED
A convincing Windows update scam is spreading malware that can grab saved passwords, cookies, payment data and Discord tokens. (Todor Tsvetkov/Getty Images)
Ways to stay safe from fake Windows update malware
You don’t need to be a security expert to avoid this. A few habits make a big difference.
1) Only update Windows from your settings
Go to Settings > Windows Update and check for updates there. Avoid downloading updates from websites.
2) Double-check the URL
Real Microsoft pages use microsoft.com. Anything else, even if it looks close, should raise a red flag.
3) Be cautious with urgent update prompts
If a site or message pressures you to install an update, stop and verify it manually.
4) Use strong antivirus software with behavior detection
Traditional antivirus software, which often comes built into your device or as basic security software, mainly looks for known threats using signature matching, which means it can miss new or well-hidden attacks like this one. Strong antivirus software uses behavior detection to monitor what programs are doing in real time, helping flag suspicious activity even if the malware hasn’t been seen before. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.
5) Use a data removal service to limit your exposure
If your personal information is already circulating online from past breaches, it can make scams like this more convincing. A data removal service helps reduce how much of your information is publicly available, making it harder for attackers to target you with tailored phishing attempts. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com
6) Turn on two-factor authentication
Two-factor authentication (2FA) adds a second layer of protection if your passwords are stolen.
7) Avoid downloading installer files from unknown sites
Legitimate updates rarely require manual downloads.
Kurt’s key takeaways
Fake updates are one of the most effective tricks because they tap into something we all trust. Keeping your system secure should not put you at risk, yet that’s exactly what attackers are exploiting here. The safest move is to slow down, verify where updates come from and stick to built-in tools whenever possible.
Are tech companies doing enough to keep fake updates from putting your data at risk? Let us know your thoughts in the comments below. Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
We get a lot of questions about how The Verge works. And how The Vergecast works. And how we make money. And whether some of that money helps Nilay buy more jackets, several yachts, or something else entirely. So, every once in a while, we spend an episode of the podcast answering as many questions as we can.
On this episode of The Vergecast, Nilay and David are joined by The Verge’s publisher, Helen Havlak, to talk about ads, subscriptions, our website, our audience, and more. Then, Nilay and David answer some more questions about how we think about journalism, our relationship with Verge alumni, video podcasts, and (of course) Brendan Carr.
Thanks to everyone who sent us questions for this episode, and please keep them coming! You can always call the Vergecast Hotline (866-VERGE11) or send us an email (vergecast@theverge.com) with your questions, thoughts, feelings, and misgivings about everything we’re up to. We truly love hearing from you. And if you want to be part of everything we’re up to, and help make The Verge even bigger and better, the best thing you can do is subscribe! You even get all our podcasts ad-free.
Oh, and also, in case you missed it yesterday, be sure and check out our emergency pod on the news that Tim Cook is stepping down as Apple CEO. We’ll be talking more about the future of Apple on Friday’s show, too, so send questions if you have ’em!
-
World9 minutes agoMoldovan oligarch sentenced to 19 years in prison over $1bn fraud
-
New York2 hours agoTrump’s Immigration Crackdown Pervades Long Island Suburbs
-
Detroit, MI3 hours agoChris Simms projects Detroit Lions first-round NFL draft pick
-
San Francisco, CA3 hours agoSan Francisco sets $3.4B price tag for public takeover of PG&E
-
Dallas, TX3 hours agoGame Day Guide: Stars at Wild | Dallas Stars
-
Miami, FL3 hours agoMay a steadying presence as Cards hold off Marlins in Miami
-
Boston, MA3 hours agoTyrese Maxey, VJ Edgecombe flex in Boston: Takeaways from Celtics-76ers Game 2
-
Denver, CO3 hours agoMotorcyclist seriously injured in Denver hit-and-run crash – AOL