Stalkerware Industry Plagued by Repeated Data Breaches, Exposing Victims and Abusers Alike Since 2017, at least 27 stalkerware companies apps marketed to jealous partners for covert surveillance have suffered hacks or major data leaks, exposing sensitive information from both customers and unwitting victims. The latest breach involves uMobix, whose payment data for over 500,000 customers was scraped and published online by a hacktivist targeting the industry’s unethical practices. ### A Pattern of Negligence and Exploitation Stalkerware apps like uMobix, Catwatchful, SpyX, Cocospy, mSpy, and pcTattletale enable illegal surveillance, often marketed as tools to "catch cheating partners." Yet their poor security has repeatedly led to massive data exposures, including: - Messages, photos, call logs, and GPS locations of victims. - Customer payment details, support tickets, and login credentials. - Real-time screenshots and audio recordings from monitored devices. In 2025 alone, Catwatchful, SpyX, Cocospy, Spyic, and Spyzie all suffered breaches, exposing millions of victims’ data. The trend extends back years, with mSpy (2024), Spytech (2024), and pcTattletale (2024) among the most high-profile cases. pcTattletale’s founder, Bryan Fleming, later pled guilty to hacking and unlawful surveillance charges after the company’s shutdown. ### Hacktivists vs. Stalkerware: A Decade of Disruption The first major stalkerware breaches occurred in 2017, when hackers targeted Retina-X and FlexiSpy, exposing 130,000 customers and wiping servers in an effort to dismantle the industry. Despite these attacks, many companies rebranded or persisted FlexiSpy remains active today, while others like Spyhide and TheTruthSpy have been hacked multiple times. Some breaches were accidental, like SpyFone’s 2018 leak of an unsecured Amazon S3 bucket containing texts, photos, and passwords. Others were deliberate acts of sabotage, such as the hacker who defaced pcTattletale’s website and leaked internal data after the app was used to monitor hotel check-in systems. ### Legal and Ethical Fallout While eight stalkerware companies have shut down due to breaches or legal action, others rebrand and resurface. The FTC banned SpyFone and its CEO in 2021 after a data exposure, and New York’s attorney general forced PhoneSpector and Highster to close for promoting illegal surveillance. Security experts, including Eva Galperin of the Electronic Frontier Foundation, note that stalkerware companies are "soft targets" due to their lax security and unethical business models. Even when apps are used "legally" (e.g., parental monitoring), their inherent insecurity puts all users at risk. ### A Declining but Persistent Threat While Malwarebytes reported a decline in stalkerware detections in 2023, experts warn that abusers may be shifting to physical tracking (e.g., AirTags) or harder-to-detect methods. The industry’s history of breaches, rebranding, and legal evasion suggests the problem remains far from resolved.

MSpy has leaked millions of sensitive records online. The database contained millions of records, including the username, password and private encryption key of each mSpy customer who logged in to the mSpy site or purchased an mSpy license over the past six months. It included passwords, call logs, text messages, contacts, notes and location data secretly collected from phones running the stealthy spyware. The private key would allow anyone to track and view details of a mobile device running the software. In addition, the database included the Apple iCloud username and authentication token of mobile devices running mSpy. Stumbled this database would have allowed to browse the WhatsApp and Facebook messages uploaded from mobile devices equipped with mSpy.