Duke University ran a 12-month study to find out how easy it is to buy personal data on US military personnel.
They set up a fake website. Used a .asia domain. Hosted it on a server in Singapore.
Then they contacted 12 US data brokers and asked to buy data on active-duty service members and veterans.
Three of them said yes. No meaningful background checks. No verification.
They bought names, home addresses, email addresses, phone numbers, health data, financial information, religion, marital status, and information about their children.
Cost: $0.12 to $0.32 per person.
The researchers noted that a foreign intelligence agency could do the same thing — and probably already has.
If this is what a university can do with a fake website and a few hundred dollars, imagine what a state-level adversary can do with a budget.