One of the largest companies that tracks Americans’ location through smartphone data has been hacked by Russian cybercriminals in exchange for ransom, according to two cybersecurity researchers, a person who has posted a massive trove of allegedly hacked files and a notice the company sent to the Norwegian government.

The incident would be one of the largest known breaches of a handful of controversial U.S. companies that sell individuals’ location data, a gold mine for advertisers as it can be used to extensively map a person’s life, usually without their knowledge.