2 million. Wrong problem to chase.
Lusha Systems Inc. collected and sold personal data of thousands of Italians through social media scraping. The data included professional information, emails, and phone numbers of institutional figures, law enforcement, and magistrates.
Everyone reads this as a data broker problem, but it's actually a third-party risk management failure. 30% of breaches in 2024 involved third-party involvement, according to Verizon DBIR 2025.
The defensive math: -> Review data handling practices to ensure compliance with GDPR and Italian privacy laws within the next 6 months -> Implement a third-party risk management framework to assess and mitigate risks from data brokers and social media scrapers within the next 9 months -> Conduct regular audits to detect and respond to unauthorized data collection and sales, aiming to reduce the median dwell time to under 14 days
Can your organization detect and respond to a data broker breach within the 14-day median dwell time?
https://tomodachi.work/zanshin/