NEW YORK (CNNMoney) 
 
 Consumer data companies are selling lists of rape victims, seniors with dementia and even those suffering from HIV and AIDS to marketers, underscoring the need for tighter government regulations, a privacy group told Congress Wednesday. 
 
 The World Privacy Forum uncovered these lists, along with several others, while investigating how data brokers collect and sell consumer information. Marketers buy this data so they can target shoppers based on everything from their income to clothing size. 
 
 Other lists the nonprofit found included the home addresses of police officers, a mailing list for domestic violence shelters (which are typically kept secret by law) and a list of people with addictive behaviors towards drug and alcohol. 
 
 The mere existence of these lists highlights the need for increased government regulations, said World Privacy Forum executive director Pam Dixon. 
 
 Related: What your zip code reveals about you 
 
 "This is where I urge Congress to take action," she said Wednesday at a Senate committee hearing. "Highly sensitive data are the frayed and ugly ends of the bell curve of lists, far from the center. This is where lawmakers can work to remove unsafe, unfair and overall just deplorable lists from circulation." 
 
 Currently, data brokers are required by federal law to maintain the privacy of a consumer's data only if it is used for credit, employment, insurance or housing. And while medical privacy laws prohibit doctors from sharing patient information, medical information that data brokers get elsewhere, such as from the purchase of over-the-counter drugs and other health care items, is fair game. 
 
 In some cases, such lists could put people in harm's way. The list of more than 30,000 police officers' home addresses, for example, could put the lives of the officers and their families in danger, said Dixon. Meanwhile, a list of seniors suffering from dementia could open them up to predatory financial offers. 
 
 Related: Find out what Big Data knows about you 
 
 Linda Woolley, president of the Direct Marketing Association, said in a statement that such lists represent a "tiny minority" of marketing products. 
 
 "We recognize that there are situations in which lists are being used to disparage certain groups," she said. "That is not something that DMA supports." 
 
 She added that some names of lists may be misleading as to the information it contains and that most lists typically focus on a person's likely interests, such as whether someone is a "sports enthusiast" or "avid traveler." 
 
 Some data brokers offer ways to opt out, but many have unclear opt-out procedures or none at all. Plus, most consumers have no idea they're on the lists in the first place, said Dixon. 
 
 Related: What your wireless carrier knows about you 
 
 Wednesday's hearing came after a year-long Senate committee investigation into the $156 billion data brokerage industry. The Federal Trade Commission has also called on major data brokers to increase transparency into their data practices. 
 
 Committee chairman John "Jay" Rockefeller criticized several of the country's largest data brokers for resisting the oversight and said he would continue to push for information on how they get data and who they sell it to. 
 
 In his closing remarks, the senator said he was "revolted" by the lists Dixon had revealed and said the commission would continue to explore the issue. 
 
 "I think it's our job as government to... bring into sunlight what is going on," he said. "I think its serious, and I think it's a dark underside of American life, in which people make a lot of money and cause people to suffer even more." ||||| The Senate Commerce Committee issued a report on the multibillion dollar data industry today, and the accompanying testimony and findings are chilling. 
 
 Over the last year, the Committee queried nine of the major data companies and invited testimony from privacy groups. What's emerged is that collectively, these companies own an astounding number of consumer profiles, and they're selling deeply personal information — sometimes to identity thieves — in categories like rape victims, people with cancer, and “Rural and Barely Making It.” 
 
 One data broker is selling lists of addresses and names of consumers suffering from conditions including cancer, diabetes, and depression, and the medications used for those conditions; another is offering lists naming consumers, their credit scores, and specific health conditions. 
 
 Of the nine companies the Committee approached — Acxiom, Experian, Epsilon, Reed Elsevier, Equifax, TransUnion, Rapleaf, Spokeo, and Datalogix — "some" were forthcoming. The report mentions Equifax as being particularly cooperative. 
 
 Others weren't. Acxiom, which according to the report has “multi-sourced insight into approximately 700 million consumers worldwide,” Experian, and Epsilon refused to explain how they collected their data or who they were selling it to, citing confidentiality clauses in their contracts. (The Attorney General of New Jersey recently released documents indicating Acxiom sold another company, Dataium, 400,000 dossiers for a mere $2,500.) 
 
 In October, Experian admitted that it sold personal information — including social security numbers and banking information — through a subsidiary to an alleged online identity theft ring. That same subsidiary, Court Ventures, also appeared on a list of companies that requested private information about gun permit holders in Virginia. 
 
 Equifax told the Committee they had information as specific as: 
 
 Whether a consumer purchased a particular soft drink or shampoo product in the last six months 
 
 Whether they use laxatives or yeast infection products 
 
 How many OB/GYN doctor visits they've had within the last 12 months 
 
 How many miles they traveled in the last 4 weeks 
 
 The number of whiskey drinks they consumed in the past 30 days. 
 
 That data is then sorted into a dictionary with more than 75,000 data points like, "whether the individual or household is a pet owner, smokes, has a propensity to purchase prescriptions through the mail, donates to charitable causes, is active military or a veteran, holds certain insurance products including burial insurance or juvenile life insurance, enjoys reading romance novels, or is a hunter." 
 
 Privacy groups testified that the companies also sell lists of rape victims and people with HIV and AIDs. 
 
 This fine-tuned data collection isn't new — last year, the Times reported a story of how Target figured out a teenager was pregnant before her father did. Even in 2007, the Times reported on a company selling lists like, “Oldies but Goodies,” 500,000 gamblers over 55 years old, for 8.5 cents each, and one list that said: “These people are gullible. They want to believe that their luck can change.” 
 
 But their databases are growing infinitely, and there are still no relevant consumer protection laws in place to protect individual privacy. And despite recent transparency efforts — like Acxiom's aboutthedata.com — that also means the consumers on these lists still have no right to find out what information is out there, or who is buying it. 
 
 [image via Shutterstock] ||||| LISTEN TO ARTICLE 7:03 SHARE THIS ARTICLE Share Tweet Post Email 
 
 More than 150,000 U.S. government and military employees are among the victims of Yahoo! Inc.’s newly disclosed data breach, and their names, passwords, telephone numbers, security questions, birth dates, and backup e-mail addresses are now in the hands of cybercriminals. It’s a leak that could allow foreign intelligence services to identify employees and hack their personal and work accounts, posing a threat to national security. These employees had given their official government accounts to Yahoo in case they were ever locked out of their e-mail. 
 
 The government accounts belong to current and former White House staff, U.S. congressmen and their aides, FBI agents, officials at the National Security Agency, the Central Intelligence Agency, the Office of the Director of National Intelligence, and each branch of the U.S. military. The list includes an FBI division chief and multiple special agents working around the U.S.; current and former diplomats in Pakistan, Syria and South Africa; a network administrator at NSA’s Fort Meade headquarters; the chief of an Air Force intelligence group; and a human resources manager for the CIA. 
 
 On Wednesday, Yahoo revealed the second major breach of its systems, following the September disclosure of a widespread hack. The newly announced intrusion, which occurred in 2013, affected more than 1 billion users, and the government employee data is likely part of that cache. The other hack was disclosed earlier but took place later, in 2014, and Yahoo has said it threatened 500 million accounts. "Yahoo has taken steps to secure user accounts and is working closely with law enforcement," the company said in a statement issued Wednesday. 
 
 The information about the government employees comes from a cyber-security researcher, Andrew Komarov, who discovered a stolen database of Yahoo user information involving hundreds of millions of accounts and turned it over to the government, which in turn alerted Yahoo. Bloomberg News reviewed the database and confirmed a sample of the accounts for accuracy. Yahoo declined to comment on the stolen government employee information. 
 
 Former intelligence officials said the leak of government worker data could make the job of foreign spies easier, creating an alphabetized hit list of targets for hacking. "We went to great lengths to keep the fact people worked at NSA as low-profile as we possibly could. The last thing we’d want is an alpha list of NSA employees," said Lonny Anderson, former technology director for the NSA and now executive vice president at security company Federal Data Systems Inc. 
 
 Gaining access to personal e-mail accounts, even unofficial ones, can be extraordinarily valuable. Clinton campaign chief John Podesta’s Gmail account was hacked in March, revealing over a decade of private communications and fueling weeks of attacks on Hillary Clinton in the crucial final weeks of the U.S. presidential election. The hack was part of a propaganda campaign that U.S. intelligence officials believe was orchestrated by Russia to influence the election. 
 
 The newly disclosed Yahoo hack -- and revelations about stolen government employee information-- could further complicate Yahoo’s attempts to sell its core internet assets to Verizon Communications Inc. for $4.8 billion, a deal that is slated close in the first quarter of 2017. Verizon’s general counsel said in October that Yahoo’s breach would likely have a material impact, meaning Verizon could demand a lower price or back out altogether. 
 
 In a statement in response to Wednesday’s hacking revelation, a Verizon spokesman said: "As we’ve said all along, we will evaluate the situation as Yahoo continues its investigation. We will review the impact of this new development before reaching any final conclusions." 
 
 Komarov found the database in August. As the chief intelligence officer for InfoArmor, a cybersecurity firm, it’s his job to prowl the internet’s darkest corners, infiltrate cybercrime rings and help law enforcement and his company’s clients track down stolen data. For the last three years, Komarov had been watching a prolific Eastern European hacker group when he saw them offering up a huge database for sale. 
 
 The group Komarov had been surveilling, which he calls Group E, was carefully keeping the sale off of public cybercrime forums. They said they had a database of logins for more than 500 million -- perhaps up to 1 billion -- Yahoo accounts for sale for $300,000. 
 
 Komarov watched the hacker group sell the database three times, and he was able to intercept the database during the sales. Two buyers were large spamming groups that are on the Spamhaus Register of Known Spam Operations, or ROKSO, list. The other had an unusual request before completing the purchase. The buyer gave the sellers a list of ten names of U.S. and foreign government officials and business executives, to verify their logins were part of the database. That led Komarov to speculate the buyer was a foreign intelligence agency. 
 
 Nearly two months later, Yahoo announced it was hacked -- the first revelation of a breach. The company said that in 2014, data on more than 500 million accounts was taken, including users’ names, e-mail addresses, dates of birth, phone numbers, and security questions and answers. The haul also included passwords, the "vast majority" of which were protected with a powerful encryption method called bcrypt, which makes it very difficult to discern passwords, the company said. 
 
 Komarov studied Yahoo’s announcement with interest. The database he had was unlike what the company described: it had different, more minimal encryption and also included users’ backup e-mail addresses. He suspected the company may have been the victim of a second major hack. He alerted law enforcement in the U.S. and U.K. in late October, and about a week later, Yahoo disclosed in a regulatory filing that it was investigating a new claim of a hack. This breach was confirmed on Wednesday. 
 
 Komarov said the group selling the database he acquired are professional cybercriminals who sell mostly to spammers, leading him to conclude that a nation was not behind this crime. The hackers are Eastern European and Komarov said based on their communications he suspects they may have never met in person. They are prolific hackers, picking major e-mail providers and social media sites to target based on how much they can sell the logins for. Their operations have netted more than 3.5 billion records from companies including MySpace, Dropbox and VK.com, a popular Russian social networking site. 
 
 The leak makes government employees especially susceptible to attacks, said Frank Zou, founder of Sunnyvale, California-based startup HoloNet Security. "They’re easy targets," he said. 
 
 Foreign spies will go down the list "one by one" trying to hack government employees, even if they’re low-level, Zou said. Hackers will look for any footholds into secure systems or sensitive files workers have sent to their personal accounts. 
 
 The Yahoo attack is different than other hacks, Komarov said, and poses danger to more than just government employees. "The Yahoo hack makes cyber espionage extremely efficient," he said. "Personal information and contacts, e-mail messages, objects of interest, calendars and travel plans are key elements for intelligence-gathering in the right hands. The difference of Yahoo hack between any other hack is in that it may really destroy your privacy, and potentially have already destroyed it several years ago without your knowledge." 
 
 — With assistance by Brian Womack, Michael Riley, and Scott Moritz
– Secretive data companies are tracking almost every American's every move online—and compiling and selling disturbingly targeted lists based on that spying, a new Senate Commerce Committee report concludes. That includes lists of rape victims, people suffering from ailments including HIV, AIDS, and dementia, and people with substance abuse problems, a privacy group said in a hearing yesterday, as per CNN. Mailing addresses for police officers and domestic violence shelters—the latter of which are usually protected by law—are also for sale, as are lists based on demographics and economics, including "Ethnic Second-City Strugglers," and "Rural and Barely Making It." The World Privacy Forum urged Congress to act to "remove unsafe, unfair, and overall just deplorable lists from circulation." The Direct Marketing Association released a statement saying that while the lists are occasionally "used to disparage certain groups," they represented a "tiny minority" of marketing products. Overall the committee looked at nine companies, some of which refused to explain how they got their data or who they sold it to, Gawker reports. One company admitted it had sold social security numbers and banking information to an alleged identity theft ring.