482 of the Alexa top 50,000 sites are recording their users' every moves, keystrokes and mouse movements included. This data is then sent to an analytics dashboard, not all times in a secure manner.
In the analytics business, such data is called a session replay. Experts argue that an attacker could intercept this data in transit, or steal it from unsecured analytics dashboards to review user input and extract sensitive information.
Nicknamed session-replay attacks, such scenarios are possible because analytics firms that provide user session recording services do not discriminate when it comes to the data they log.