ClearPhish, a cybersecurity firm, found a database of approximately 7.6 million Waze user records being sold on a dark web marketplace. The alleged data includes usernames, unique user IDs, GPS coordinates, and travel history. Google has not officially confirmed the data leak. Malaysia’s National Security Council has directed civil servants to uninstall Waze citing data security concerns , though ordinary Malaysians are not currently banned from using the app. The data’s authenticity has not been independently verified.
What Was Found on the Dark Web
The listing surfaced on a dark web marketplace sometime before October 22, 2026, when ClearPhish published its report. The seller claims to have a structured database with nearly 7.7 million individual user records, each containing a Waze username, a unique user ID, real-time GPS coordinates, and travel history logs.
None of the records in the listing appear to include passwords or payment information, but that doesn’t mean the risk is low. The combination of real-time GPS data and a unique user identifier is arguably more dangerous than a stolen password, because a password can be changed. Your location history and your daily routines cannot.
The claim remains unverified. Google has not confirmed that any breach of Waze’s systems occurred. Datasets like this are sometimes compiled from previous breaches, scraped from APIs, or partially fabricated to add bulk around a smaller set of genuine records. Any of those origins would carry different implications for the scope of the risk.
Why GPS and Travel History Data Is Particularly Dangerous
Most breach coverage focuses on credentials, financial data, or identity documents. Location data is often treated as less serious because it doesn’t directly enable bank fraud or account takeovers. That assessment misses what navigation app data actually reveals about a person.
Your travel history in Waze is essentially a diary of where you live, where you work, and how you move between them. If you leave your house at 7:15 every morning and arrive at the same office at 8:00, that routine is encoded in your location history. If you regularly stop at a particular coffee shop or visit a specific address on weekends, that’s in there too.
Real-time GPS coordinates elevate this further. A criminal who knows both your daily routine and your current location isn’t just tracking you historically, they can find you right now.
ClearPhish specifically warned that if the data is confirmed authentic, it could be “exploited for various malicious purposes, including stalking individuals, identifying travel routines and planning targeted attacks.” Unique user IDs compound the problem by allowing the same person to be tracked consistently across time, even if they change their display name.
This connects directly to concerns about how personal data from large exposures enables targeted physical threats the IDScan.net breach exposed home addresses that researchers flagged as dangerous specifically for domestic violence survivors and people under protective orders. GPS travel history on 7.6 million people carries equivalent risk at far greater scale.
The Malaysian Government Response
This data leak didn’t land in a vacuum in Malaysia. It arrived alongside an already-active government debate about whether Waze should be allowed in the hands of civil servants at all.
Malaysia’s National Security Council (NSC) issued a directive to civil servants to stop using Waze, citing concerns about the app’s collection of location data and travel movement information. Digital Minister Gobind Singh Deo clarified that the directive was based on “two considerations: data security and legal aspects” and was specifically aimed at civil servants, not the general public. Ordinary Malaysians are not prohibited from using Waze.
The government is, however, encouraging members of the public to voluntarily uninstall the app, a softer form of the same message.
Waze pushed back. The company denied that its navigation application poses a security risk, said it does not collect sensitive government information, and stated that it operates under strict privacy policies designed to comply with global data protection standards.
This tension , a government citing data risks, a company denying them, and a ClearPhish report appearing in the middle, is not a new dynamic. Navigation apps collect location data as a function of their basic operation. The question of what happens to that data, who can access it, and how it might be aggregated or sold is one that regulators across multiple countries have been asking for years.
Previous Waze Security Concerns
The ClearPhish report noted this isn’t the first time Waze’s security has come under scrutiny.
Security researcher Peter Gasper previously disclosed weaknesses in Waze’s application programming interface (API) that could have been exploited to track users’ real-time movements. An API is the technical mechanism Waze uses to share and receive data, route information, traffic updates, location signals. A poorly secured API can be queried by unauthorized parties to extract data that was never meant to be public.
Google reportedly addressed the specific weaknesses Gasper identified. But the current listing raises the question of whether that remediation was complete, or whether additional vulnerabilities remain. ClearPhish specifically questioned “whether Waze still has significant security weaknesses” given the API exposure history.
The question of whether route preferences, shared reports, and other user-generated content within Waze were also affected remains unanswered.
What Waze Users Should Do
Even with the authenticity of this specific dataset unconfirmed, the practical response for anyone who uses Waze regularly is straightforward.
Review your Waze privacy settings. Waze allows users to limit location sharing, disable the history of saved places, and control whether their movement data is shared with the broader user community. Going to Settings within the app and examining what is shared and retained is a sensible first step regardless of this incident.
Consider whether Waze needs your full travel history. Many navigation apps store history locally and in cloud accounts. Clearing your route history and disabling the feature that saves frequently visited places removes a portion of what would be contained in a database like the one described.
Watch for targeted phishing. If this data is genuine and circulating, scammers will use it. A phishing message that references a destination you’ve recently navigated to, or a caller who mentions an address you visit regularly, is more convincing than a generic scam attempt. Navigational data makes social engineering more targeted, as we’ve covered in looking at how stolen data enables increasingly personalised fraud attacks.
Don’t assume silence from Google means you’re safe. As we’ve documented in multiple breach cases this year , from Substack to Services Australia’s Medicare situation , companies often take time to confirm breaches, during which the data can already be in circulation.
For the full checklist of what to do when your data may have been exposed, our dark web data guide covers the steps in priority order.
The Bigger Picture
Navigation apps occupy an unusual position in the data ecosystem. They are useful precisely because they collect granular, real-time location data. That same data, if exposed, reveals things about users that most other apps never capture, daily commutes, home addresses inferred from starting locations, places visited at night, medical and religious destinations.
Whether the Waze dataset is genuine, partial, or fabricated, it illustrates why location data is increasingly among the most commercially valuable types of personal information on dark web markets and why governments and security researchers are treating navigation apps with a level of scrutiny that would have seemed disproportionate just a few years ago.
Frequently Asked Questions
Was Waze definitely hacked?
No confirmed breach as of October 25, 2026. Google has not confirmed the claim. The data’s authenticity is still being investigated.
Is Waze banned in Malaysia?
No total ban. The Malaysian government directed civil servants to stop using Waze, citing data security and legal concerns. Ordinary Malaysians are encouraged but not required to uninstall it.
What data was allegedly leaked?
Usernames, unique user IDs, real-time GPS coordinates, and travel history for approximately 7.6–7.7 million users.
Why is GPS data dangerous if leaked?
Location history reveals home and work addresses, daily routines, and regular destinations. Real-time coordinates enable live tracking. These details enable stalking, targeted physical attacks, and highly personalized social engineering.
