Disturbing information found on military device sold for less than $70 on eBay

For $68, you can buy almost anything on eBay these days, but you wouldn't imagine one of those things to be a piece of U.S. military technology packed with tonnes of highly sensitive data.

That's just what a group of German security researchers were able to get their hands on after securing a "Buy it Now" offer on the multinational e-commerce site.

They placed their bid on an item labelled as a 'Secure Electronic Enrollment Kit', also known as a SEEK II. The device was listed for $149.95, but after lowballing the price with an instant-buy offer, they were accepted at less than $70.

Researcher Matthias Marx and his team have purchased six ex-military gadgets over the last year, including this U.S. military piece which consists of a small screen, compact keyboard and trackpad - as well as a thumbprint reader and iris scanner. Marx told The New York Times that he tested the gadget on himself before receiving a message telling him to 'connect to a U.S. Special Operations Command server to upload the new collected biometrics'.

Diego González/Unsplash

Two of the devices Marx and his team had recently acquired contained loads of sensitive information regarding over 2,600 of people in Asia and the Middle East - mostly from Afghanistan or Iraq - which could prove to be a huge issue for the American government and those affected by the data breach. Sensibly, Marx refused to upload the data to the internet over fears of safety for those involved, but the device's authenticity has been confirmed by a New York Times reporter.

Though a portion of the data may have just belonged to civilians, some of the people documented will have been working with the Coalition Forces. As such, a breach of this scale could pose a major risk if the data was to have fallen into the wrong hands.

While we're still not sure why or how the device appeared on eBay, or where the sensitive information came from, the U.S. military have provided a comment regarding the incident.

Defense Department press secretary Brig. Gen. Patrick S. Ryder said in a statement to The New York Times: "Because we have not reviewed the information contained on the devices, the department is not able to confirm the authenticity of the alleged data or otherwise comment on it.

"The department requests that any devices thought to contain personally identifiable information be returned for further analysis."

The U.S. military have also requested that the device be sent to Fort Belvoir in Virginia for further inspection.