Technology
Your health data is being sold without your consent
NEWYou can now listen to Fox News articles!
Your health information might feel private and secure with your doctor, but the reality is far more complicated. Data brokers collect a wide range of sensitive health data, from diagnoses and prescription details to personal identifiers, and sell this data to marketers, insurers, and other third parties. These buyers use the information to target ads, adjust insurance premiums, or even for purposes you might not expect. Understanding who holds your health data and how it’s used and shared is crucial to protecting your privacy.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join.
A woman viewing her health app. (Kurt “CyberGuy” Knutsson)
Massive health data breaches are fueling the data broker industry
You might think your health data is safe with your doctor. But what if I told you total strangers might know when you last Googled “early signs of dementia” or filled a prescription for anxiety meds, and they’re selling that to whoever is willing to pay for it? A recent data breach at Yale New Haven Health, Connecticut’s largest healthcare system, exposed sensitive information on 5.5 million people. And it’s not an isolated incident; new research shows that since 2020, approximately 94.5 million Americans may have had their Social Security numbers stolen during health data breaches. The scary part is that data brokers collect and sell the names, addresses, and prescribed medications of patients diagnosed with mental health disorders to marketers on a large scale. How much is your medical information worth? Data brokers can sell it for as little as $0.06 per record. Let’s break down what these data brokers know, who they’re selling it to, and why it matters for you, your family, and especially vulnerable groups like seniors.
Illustration of a medical record. (Kurt “CyberGuy” Knutsson)
CUSTOM DATA REMOVAL: WHY IT MATTERS FOR PERSONAL INFO ONLINE
What types of health information are data brokers selling?
There’s a difference between protected health information, the kind your doctor and health insurer have to keep private, thanks to HIPAA, and the health-adjacent data you leave behind everywhere else.
Data brokers typically don’t have access to your official medical records. But they’re not regulated under HIPAA or any other laws, so they can legally collect:
- Fitness app data: Step counts, heart rate, calories burned.
- Symptom-related Google searches: Even “early signs of dementia” or “knee pain at night.”
- Pharmacy purchases: Both prescriptions and over-the-counter medications.
- Wellness quizzes and online forms: Those “What’s your biological age?” surveys aren’t just for fun.
- Social media posts and likes: Public posts about health topics, comments in support groups.
- Location data: Visits to clinics, pharmacies, or addiction recovery centers.
And it doesn’t stop there. Non-health data, like where you shop or the ads you click, gets combined to build a disturbingly accurate health profile.
A woman using a health app to keep track of pills (Kurt “CyberGuy” Knutsson)
WHAT HACKERS CAN LEARN ABOUT YOU FROM A DATA BROKER FILE
Why selling your health data is more dangerous than you think
This isn’t harmless marketing data. When health information lands in the wrong hands, it creates real risks:
- Higher insurance premiums or limited coverage based on inferred health risks.
- Scams targeting seniors and vulnerable groups use lists of people flagged for dementia, heart disease, or other conditions.
- Privacy violations, exposing sensitive details like mental health struggles or fertility treatments.
- Discrimination in hiring, housing, or services based on health-related data.
- Resale to unknown third parties, making it impossible to control once it’s out there.
And it’s not just marketers. A recent government-backed autism study led by Robert F. Kennedy Jr. sparked outrage after it was revealed that private health data was collected from federal and commercial databases without clear safeguards. Security experts warn that this kind of large-scale data collection runs the risk of exposing deeply personal information with little oversight.
A healthcare professional looking at health data on a tablet. (Kurt “CyberGuy” Knutsson)
THINK YOU CAN DELETE YOUR OWN DATA? WHY IT’S HARDER THAN YOU THINK
8 ways to protect your health data from data brokers
Worried about who has access to your health data? While you can’t control every breach or broker, you can take steps to limit what’s collected, shared, and sold. Here’s how to take back control of your digital health footprint-starting today.
1) Use a personal data removal service: Data brokers collect and sell sensitive health information, including diagnoses, prescriptions, and personal identifiers, to marketers, insurers, and other third parties. This means details about your pharmacy purchases, symptom-related searches, and more could be circulating without your knowledge. A personal data removal service can help you take back control. This is one of the most effective ways to safeguard your privacy and protect yourself and your family from risks like scams, higher insurance premiums, and discrimination.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap – and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you. Check out my top picks for data removal services here.
Get a free scan to find out if your personal information is already out on the web
2) Audit your apps and privacy settings: Health and fitness apps collect more than you realize. Delete the ones you don’t trust and check permissions on the rest
3) Be wary of free health quizzes and symptom checkers: If a site asks for personal details in exchange for “insights,” assume it’s monetizing your answers. Consult your doctor, not a clickbait quiz.
4) Limit data sharing beyond healthcare providers: Only provide necessary information when signing up for health-related services or apps. Be wary of sharing health details on social media or in public forums, as these can be scraped by data brokers.
5) Request data minimization from providers: Ask your healthcare providers to collect and store only the minimum amount of personal information necessary for your care, reducing the risk if their systems are compromised.
6) Use strong antivirus software: Strong antivirus software acts as a shield, protecting your devices from malware, ransomware, and other cyber threats that could compromise your personal health data. Choose a reputable solution that offers real-time threat detection, regular updates, and robust protection for all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Keeping your antivirus up to date is crucial for blocking malicious links and downloads before they can do harm. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices.
7) Regularly update your software: Cyber threats targeting health data are constantly evolving, and outdated software can leave your devices vulnerable to attacks that expose your sensitive information. Keeping your operating system, apps, antivirus, and security tools up to date ensures you have the latest protections against malware, ransomware, and other exploits that data brokers or hackers might use to access your health information. Regular updates patch security holes before they can be exploited, helping to prevent breaches like those that have exposed millions of Americans’ health details in recent years.
8) Use strong and unique passwords: Your health data is often protected by passwords on apps, portals, and devices. Using strong, unique passwords for each account reduces the risk that a single breach could give someone access to multiple sources of your personal information. Avoid common or reused passwords, and consider using a password manager to generate and store complex passwords securely. This step is crucial because once your login credentials are compromised, data brokers or cybercriminals can gather and sell your health-related data, leading to privacy violations, discrimination, or targeted scams. Consider using a password manager to generate and store complex passwords. Get more details about my best expert-reviewed Password Managers of 2025 here.
Kurt’s key takeaways
Your health should be personal, but in today’s digital world, that privacy is constantly under threat. Even if you’re cautious, your health-related information can be collected, analyzed, and sold without your clear consent. The good news is that you can take real steps to reduce your exposure and protect what matters. This isn’t about fear; it’s about staying informed and taking control of your digital footprint.
Should lawmakers and tech companies be doing more to protect our health data, or is it all on us to safeguard our own privacy? Let us know by writing to us at Cyberguy.com/Contact.
For more of my tech tips & security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you’d like us to cover.
Follow Kurt on his social channels
Answers to the most asked CyberGuy questions:
New from Kurt:
Copyright 2025 CyberGuy.com. All rights reserved.
SpaceX and Cursor are now working closely together to create the world’s best coding and knowledge work AI.
The combination of Cursor’s leading product and distribution to expert software engineers with SpaceX’s million H100 equivalent Colossus training supercomputer will allow us to build the world’s most useful models.
Cursor has also given SpaceX the right to acquire Cursor later this year for $60 billion or pay $10 billion for our work together.
NEWYou can now listen to Fox News articles!
If you’ve ever clicked “Check for updates” and trusted what you saw, you’re not alone. That’s exactly what this latest scam is counting on.
The page mimics official branding, includes a believable knowledge base number and presents a big blue download button that feels familiar.
The catch? The download installs malware designed to steal passwords, payment details and account access.
According to researchers at Malwarebytes Labs, a cybersecurity research and threat intelligence team inside Malwarebytes, the site uses a typosquatted domain that looks close enough to a real Microsoft URL to fool a quick glance. That small trick is often all it takes.
APPLE APP PASSWORD SCAM EMAIL WARNING
Cybersecurity researchers warn a fake Microsoft update site uses a look-alike URL and a familiar download button to deliver data-stealing malware. (Michael Nagle/Bloomberg via Getty Images)
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Why this fake Windows update malware slips past detection
At first glance, nothing seems off. The file looks like a standard Windows installer. It even lists “Microsoft” in its properties. That’s where this attack gets clever. Instead of using obvious malicious code, the attackers built the installer with legitimate tools and layered the attack in stages. Each piece looks harmless on its own.
Here’s what’s happening behind the scenes:
- The installer launches what appears to be a normal app
- That app quietly runs hidden scripts
- A disguised process loads a full Python environment
- Data theft tools activate in the background
Because each step looks routine, many security tools fail to flag it right away. Researchers also noted that antivirus engines initially showed zero detections for key parts of the attack. That does not mean the file is safe. It means the malicious behavior is well hidden.
What this fake Windows update malware is stealing
Once installed, the malware gets to work fast. It collects details about the infected device, including location and IP address. Then it reaches out to remote servers to receive instructions and upload stolen data.
The targets include:
- Saved browser passwords
- Login sessions and cookies
- Payment details
- Discord account tokens
It even tries to shut down other processes on your system to avoid interference while it works. In some cases, it modifies apps like Discord to intercept account activity in real time.
How the fake Windows update malware stays on your system
This malware is designed to stick around. It creates entries that look like normal system processes, so they blend in. One registry entry mimics Windows Security Health, which most users would ignore. It also drops a shortcut in your startup folder with a familiar name like Spotify. That makes it easy to overlook. Two different persistence tricks mean it can survive a reboot and keep running.
FAKE WINDOWS UPDATE PUSHES MALWARE IN NEW CLICKFIX ATTACK
A fake Windows update page is tricking users into downloading malware that steals passwords, payment details and account access. (Beata Zawrzel/NurPhoto)
Why this fake Windows update scam feels so real
There’s a bigger trend behind this. Researchers say campaigns like this often target regions where large data breaches have already exposed personal information. When attackers already know your name, provider or habits, they can build scams that feel tailored to you. That makes a fake Windows update page far more believable than a generic phishing email.
It also highlights something important. Today’s malware often hides inside legitimate tools and trusted frameworks. That makes it harder to detect and easier to trust. This campaign shows how far scammers have come. They are no longer relying on sloppy emails or obvious fake links. Instead, they are building layered attacks that look and behave like trusted software.
Even experienced users can get caught off guard when everything appears normal. The biggest takeaway is simple. A clean scan result or a familiar interface does not guarantee safety.
Microsoft says it’s aware of the threat
Microsoft confirmed it is tracking this type of activity and urges users to be cautious when downloading updates from unfamiliar sources.
“We are aware of reports of fraudulent websites impersonating Microsoft, and we actively work to detect and disrupt malicious activity across the internet,” A Microsoft spokesperson told CyberGuy. “We encourage customers to be cautious of unexpected prompts or downloads and to verify that they are interacting with legitimate Microsoft domains. As a best practice, we recommend users verify the legitimacy of a link by going directly to our website from your own saved favorite, from a web search, or by typing the domain name yourself.”
For more guidance on how to protect against online phishing scams, you can refer to Microsoft’s official support page at support.microsoft.com.
MICROSOFT CROSSES PRIVACY LINE FEW EXPECTED
A convincing Windows update scam is spreading malware that can grab saved passwords, cookies, payment data and Discord tokens. (Todor Tsvetkov/Getty Images)
Ways to stay safe from fake Windows update malware
You don’t need to be a security expert to avoid this. A few habits make a big difference.
1) Only update Windows from your settings
Go to Settings > Windows Update and check for updates there. Avoid downloading updates from websites.
2) Double-check the URL
Real Microsoft pages use microsoft.com. Anything else, even if it looks close, should raise a red flag.
3) Be cautious with urgent update prompts
If a site or message pressures you to install an update, stop and verify it manually.
4) Use strong antivirus software with behavior detection
Traditional antivirus software, which often comes built into your device or as basic security software, mainly looks for known threats using signature matching, which means it can miss new or well-hidden attacks like this one. Strong antivirus software uses behavior detection to monitor what programs are doing in real time, helping flag suspicious activity even if the malware hasn’t been seen before. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.
5) Use a data removal service to limit your exposure
If your personal information is already circulating online from past breaches, it can make scams like this more convincing. A data removal service helps reduce how much of your information is publicly available, making it harder for attackers to target you with tailored phishing attempts. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com
6) Turn on two-factor authentication
Two-factor authentication (2FA) adds a second layer of protection if your passwords are stolen.
7) Avoid downloading installer files from unknown sites
Legitimate updates rarely require manual downloads.
Kurt’s key takeaways
Fake updates are one of the most effective tricks because they tap into something we all trust. Keeping your system secure should not put you at risk, yet that’s exactly what attackers are exploiting here. The safest move is to slow down, verify where updates come from and stick to built-in tools whenever possible.
Are tech companies doing enough to keep fake updates from putting your data at risk? Let us know your thoughts in the comments below. Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
We get a lot of questions about how The Verge works. And how The Vergecast works. And how we make money. And whether some of that money helps Nilay buy more jackets, several yachts, or something else entirely. So, every once in a while, we spend an episode of the podcast answering as many questions as we can.
On this episode of The Vergecast, Nilay and David are joined by The Verge’s publisher, Helen Havlak, to talk about ads, subscriptions, our website, our audience, and more. Then, Nilay and David answer some more questions about how we think about journalism, our relationship with Verge alumni, video podcasts, and (of course) Brendan Carr.
Thanks to everyone who sent us questions for this episode, and please keep them coming! You can always call the Vergecast Hotline (866-VERGE11) or send us an email (vergecast@theverge.com) with your questions, thoughts, feelings, and misgivings about everything we’re up to. We truly love hearing from you. And if you want to be part of everything we’re up to, and help make The Verge even bigger and better, the best thing you can do is subscribe! You even get all our podcasts ad-free.
Oh, and also, in case you missed it yesterday, be sure and check out our emergency pod on the news that Tim Cook is stepping down as Apple CEO. We’ll be talking more about the future of Apple on Friday’s show, too, so send questions if you have ’em!
-
Austin, TX2 minutes agoAppeals court rules Texas can require public schools to display Ten Commandments in class
-
Alabama8 minutes agoAlabama Defeated By Birmingham
-
Alaska14 minutes agoHawaiian, Alaska reservation systems merge: Big changes for travelers start April 22
-
Arizona20 minutes agoMichigan defenseman Hunter Hady transfers to Arizona State
-
Arkansas26 minutes ago
#24 Arkansas Explodes for Eight Runs in Eighth to Race past Missouri State in Midweek Rematch
-
California32 minutes agoCalifornia Islamic calligraphy artist preserves ancient tradition during Arab American Heritage Month
-
Colorado38 minutes agoAvalanche vs. Kings Game 2: Key takeaways as Colorado wins OT thriller, takes 2-0 series lead
-
Connecticut44 minutes agoOpinion: This Earth Day make polluters pay