A look at India's booming dark data economy: stalkerware and spyware apps, databases about parents, cable customers, pregnant women, mutual fund investors, more
and monetized. @snigdhapoonam & Samarth Bansal report for @restofworld. https://restofworld.org/... Anup Kaphle / @anupkaphle : In India, lax privacy laws and high consumer demand are driving a thriving market for personal information Fascinating reporting by @snigdhapoonam & Samarth Bansal on how scammers are turning troves of personal data into cash https://restofworld.org/...
Context & Ripple Effects
India's data economy has been running on two parallel tracks. On the consented side, regulators have been building an account aggregator framework meant to give citizens controlled access to their own financial data. On the dark side, the supply chain has been visible for years: firms like GMobi and MoMagic harvest user data through pre-loaded apps on cheap smartphones, spyware vendor SpyHuman was itself hacked with call metadata and texts stolen, and researchers documented how stalkerware is marketed to abusive spouses.
The Rest of World investigation by Snigdha Poonam and Samarth Bansal closes the loop between those tracks: it shows the harvested troves — databases covering parents, cable customers, pregnant women, mutual fund investors — being actively monetized by scammers, in the same ecosystem where India has emerged as a hub for hack-for-hire operations targeting politicians, companies, and activists.
First-order effects
- The people catalogued in these databases — including pregnant women and mutual fund investors — are directly exposed to targeted scams, since brokers now hold enough context to make fraudulent pitches credible.
- Indian spyware and stalkerware operators face the same exposure that hit SpyHuman, whose stolen call metadata showed the vendors themselves are porous targets.
Second-order effects
- Vigilante hacking of spyware vendors, already documented in the SpyHuman breach, gets fresh justification as reporting ties their product to downstream fraud — raising operating risk for anyone selling surveillance apps in India.
- Legitimate financial-data intermediaries building the account aggregator system face a trust problem: every dark-market database story makes consumers warier about consenting to share data at all.
Third-order effects
- If the pattern holds, India's data economy splits structurally into a regulated consent layer and an unregulated resale layer, forcing the question of whether privacy legislation or platform-level enforcement actually reaches the brokers doing the selling.
- The same collector-aggregator-monetizer structure documented in the $12B location data market suggests illicit databases are not an India anomaly but the local expression of a global trade in personal information.
The trend: Personal data in India is shifting from a harvesting byproduct to a tradable commodity, with the gap between consent-based frameworks like account aggregation and the unregulated broker market defining where the next regulatory fight lands.