New York (CNN) At least 50,000 American license plate numbers have been made available on the dark web after a company hired by Customs and Border Protection was at the center of a major data breach, according to CNN analysis of the hacked data. What's more, the company was never authorized to keep the information, the agency told CNN.

"CBP does not authorize contractors to hold license plate data on non-CBP systems," an agency spokesperson told CNN.

The admission raises questions about who's responsible when the US government hires contractors to surveil citizens, but then those contractors mishandle the data.

"[CBP] keeps seeking to amass more information in a way that is concerning from a privacy and civil liberties standpoint, but also from a security standpoint, given that they've not demonstrated they can safeguard that information," Neema Singh Guliani, senior legislative counsel at the American Civil Liberties Union, told CNN.

CBP collects license plate information to track which vehicles cross the border.

Read More