[Breaches](/breaches) Sixth Sense: GPS and AI Data Exposed for Assistive Devices [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Sixth Sense: GPS and AI Data Exposed for Assistive Devices ##### [UpGuard Team](/team/upguard) Published Jan 30, 2025 ##### Join 27,000+ cybersecurity newsletter subscribers ## Discovery  UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker and assistive technology for children and adults with special needs. The database contained 30 indexes of log files, each of which contained around 120 million entries. Those log files contained data generated during the sale and operation of AngelSense systems, including shipping addresses, contact information, partial credit card numbers, passwords, GPS coordinates, and metadata related to the AI decision engine for determining the status of the people being monitored.  UpGuard analysts detected the potential data exposure on January 17, 2025. On the same day, UpGuard emailed AngelSense. On January 24, when the database was still accessible, UpGuard called AngelSense’s US phone number and spoke with a support person who said they had received the email and it had been escalated for review. On the morning of January 27, UpGuard confirmed the database was no longer accessible.  ## Exposed data The data collection was organized into 53 different indexes, 30 of which were sizable collections of log files. In total, those indexes contained over 3 billion objects with a storage size of 1.8 terabytes. Downloading the complete data set was not feasible, but using the Elasticsearch query system, UpGuard analysts were able to identify and download samples of data illustrating the different kinds of exposure. Each object was a log message from an AngelSense system. Logs can contain all kinds of information. Many logs are not particularly interesting in isolation, documenting system actions that require context to be meaningful. In this case, however, there were also log files from the “Production\_US” system that contained personal information for the buyers of the AngelSense offering and the people whom they wanted to protect.  ## Purchase details One type of data found in the logs was purchases of the AngelSense hardware GPS tracker and/or the software subscription service. The data included in some, but not all cases, shows the buyer’s name, shipping address, email address, phone number, credit card expiration date, credit card last four digits, and whether there was a sponsoring organization involved.  ## User passwords Some logs included user account information including the name of the user, their email address, password, and the “angel” inviting them to the platform. The passwords were unique across users and satisfied password complexity standards for length and mix of characters, suggesting these passwords were intended for real use.  ## End user descriptions and location data The AngelSense system allows guardians to track the location of people with special needs and communicate with them if they are in danger. Some of the logs capture the GPS coordinates of the users being tracked and information about their movement used to infer their location like their speed, heading, and steps per minute. The account data for the devices includes data about the person being monitored including their year of birth and a list of the special needs like autism, dementia, down syndrome, or other conditions.  ## AI decision-making AngelSense operates by determining whether a monitored person is in peril, “utilizing AI to overcome the inherent limitations of GPS.” Log files recorded the AI decisions, summarizing changes in geolocation data into an ostensible narrative of that person’s activity. ‍ ## Partner organizations AngelSense partners with, and is distributed by, U.S. police departments and other community organizations that provide care for people with special needs. The partner organizations were documented through the account information, which sometimes included the name of the organization and the SSIDs of their wireless networks.  # Analysis Using technology to make vulnerable people safer is a laudable mission, but handling the data for such a project creates an equal responsibility for care. Personally identifiable information, payment information, and user passwords are well recognized classes of data that need to be kept private. One way to reduce the risk of  handling these types of data is to ensure they are only stored in a database, not sent to logging systems in plaintext.  Perhaps more disconcerting is the exposure of the location data for the individuals being monitored. The significance of exposing this data can be gauged by looking at recent efforts to ensure its privacy, like in the [California Consumer Privacy Act](https://www.upguard.com/blog/what-is-the-ccpa) or the stalled bipartisan [Geolocation Privacy and Surveillance Act](https://en.wikipedia.org/wiki/Geolocation_Privacy_and_Surveillance_Act), or the risk it poses when obtained illicitly, like in the [Gravy Analytics breach](https://techcrunch.com/2025/01/13/gravy-analytics-data-broker-breach-trove-of-location-data-threatens-privacy-millions/). The exposed data also illustrates how AI creates the risk of exposing an additional layer of insights on top of the raw data collected. In theory, AI is not adding any new data here, but it is creating information by using that data to better estimate the user’s location and their status. Turning a set of latitude and longitude coordinates into the story of a person's life is the promise of what AI can do for tracking applications like this. It also means that the exposure of AI-inferred decisions can reveal more about the people it affects.  AngelSense helps protect some of society’s most vulnerable people, but also illustrates the need to determine what level of security practices should be required of such a service. Their Trust and Security page says they encrypt data in transit and at rest, which are good practices; but [AngelSense’s Privacy and Security page](https://www.angelsense.com/help/data-privacy-and-security/) does not mention auditing against holistic security frameworks like [ISO 27001](https://www.upguard.com/blog/iso-27001-implementation-checklist) or SOC2. While the hardware costs of creating GPS tracking devices have become quite low—similar products can be found on Amazon as low as $10—such systems still require investment in the security and privacy practices to safely handle the data produced by them. ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)