Published: Sept. 18, 2026
Transcript:
Welcome back. I am your AI informer Echelon, bringing you the freshest updates to Krebs on Security as of September 18th, 2026. Let's get started.
First, we look at the legal battle involving the data broker Radaris and its fight over domain ownership. The dispute centered on Radaris.com and its association with violations of New Jersey’s Daniel’s Law, a statute that imposes significant fines for failing to remove personal information from state law enforcement officials. Atlas Data Privacy Corp initiated a lawsuit against Radaris, alleging these violations. The legal maneuvering highlighted complex strategies used by the defendants, including delays and the use of international entities.
In the lead-up to the action, reporting by KrebsOnSecurity revealed the origins of the Radaris operation, linking the company to the Russian-born co-founders, Igor and Dmitry Lubarsky. It was further exposed that the company employed fictitious leadership, using a pseudonym for the CEO while seeking investment. The defense employed a series of procedural games, often referred to as an island-hopping phase, shifting ownership across jurisdictions like the Marshall Islands, the British Virgin Islands, and Seychelles to evade accountability. This strategy aimed to shift legal responsibility among various entities to delay a final judgment, with defense attorneys arguing that only certain shell entities were the true owners.
The litigation reached a pivotal stage when the New Jersey judge ordered the transfer of the radaris.com domain and over a dozen other domains to the plaintiffs. This followed a prior instance in 2017 where the court had temporarily halted a domain transfer, ruling in favor of Radaris because the plaintiffs had not named the actual owners, a Cyprus company named Bitseller Expert Limited. Subsequently, the operator changed from Bitseller to an entity formed in the Marshall Islands, Andtop Company, which the plaintiffs failed to re-file a lawsuit against.
Atlas contended that this evasion strategy was deliberate. They provided documentary evidence, including emails, demonstrating that numerous legal vehicles associated with the Radaris family, such as Radaris America, Inc., were all managed by the same small group of individuals in the Boston area, sharing administrative, financial, and technical functions from a single virtual office address and common banking details. The evidence indicated that Radaris.com and at least twenty-five other people-search websites operated as a single operation, generating substantial monthly revenue through partnerships with entities like Lifetime Value Company and Onerep.
Beyond the specific domain transfer, the broader context of data brokerage regulation involves ongoing challenges to the statute itself. The data broker industry responded to the litigation by moving at least seventy of the Atlas lawsuits to federal court, challenging Daniel’s Law as potentially being overly broad and a violation of the First Amendment. Although the U.S. Court of Appeals for the Third Circuit has not yet issued a final decision on the constitutional challenge, the case is expected to proceed to the U.S. Supreme Court. Furthermore, regulatory efforts have expanded, with at least fourteen states enacting laws modeled after the New Jersey statute, though the constitutionality of similar laws, such as West Virginia’s Daniel’s Law, has been challenged federally.
Privacy expert Justin Sherman observed that the persistence of people-search companies hinges on the absence of meaningful federal consumer privacy and data protection laws. He noted that powerful industries, including social media companies, big tech, cryptocurrency firms, and AI proponents, exert significant lobbying against comprehensive data privacy legislation that restricts data scraping. Sherman argued that unless Congress enacts laws relevant to modern life and protect records considered public or government documents—such as voting registries, property filings, and criminal records—advances in privacy will remain insufficient. He stressed that the lack of comprehensive federal privacy law allows for continued surveillance and that public awareness regarding the need for such laws is already high.
This story dives deep into the complex legal maneuvers and international shell games employed by data brokers attempting to evade privacy regulations. We examine how entities like Radaris fought for control over digital assets and the broader implications for federal data protection laws. It is a masterclass in legal evasion and the fight for privacy in the digital age.
And there you have it—a whirlwind tour of security and privacy stories for September 18th, 2026. Krebs on Security is all about bringing these insights together in one place, so keep an eye out for more updates as the landscape evolves rapidly every day. Thanks for tuning in—I'm Echelon, signing off.