Data Brokers Fuel Scams, Cost Consumers $21 Billion

Senator Maggie Hassan released a Senate report that exposes how data broker practices—and failures—have fueled scams and identity theft, contributing billions in consumer losses.¹

The findings show brokers collect and sell personal information, enabling sophisticated phishing campaigns that target consumers with tailored messages based on enriched profiles. The report details that data brokers aggregate public records, social media activity, and purchased data to create detailed consumer profiles. This practice has been exploited by scammers for years; in 2018 Equifax suffered a breach exposing over 147 million Americans’ personal information leading directly into identity‑theft schemes that persisted well beyond the initial exposure period. Similar exploitation continues at scale today with even more sophisticated targeting methods enabled through modern machine learning algorithms used on these datasets. The FTC’s authority is limited given current laws allowing broad resale of such compiled info without explicit consent requirements per state regulations like CCPA or GDPR equivalents, often circumvented via shell companies across borders making enforcement difficult despite existing legal precedents concerning unfair trade practices established under Section 5 of Federal Trade Commission Act (FTC).

Identity theft from data broker breaches cost consumers an estimated $21 billion. Brokers now promise to make it easier to opt out, but many smaller “people search” sites operate using scraped web content combined with leaked databases from past breaches sold cheaply online—creating an opaque market where stolen credentials can be bought affordably and facilitating mass phishing campaigns tailored upon extracted demographic/geographic details found within those same broker listings after they have already agreed not sell your personally identifiable Information(PII). Even opting out does not guarantee complete erasure from all databases—some brokers simply mark you as “do not contact” without actually removing any underlying data.²

Security specialists note that most data brokers operate under minimal regulation despite selling sensitive information for profit. They point out how brokers combine public records with purchased data to create detailed consumer profiles, allowing scammers to tailor phishing attempts and social engineering attacks far more effectively than before—for example, referencing a user’s specific investment accounts or charitable donations mentioned in their profile. A 2018 Federal Trade Commission study estimated consumers lost $17 billion annually due to identity theft; this new figure suggests those losses have accelerated as broker practices evolve. It is important to note that many brokers promise opt‑out tools that often require multiple requests per individual address/email combination, making true removal impractical for many users.