Hacked leaked exposed Why you should never use stalkerware apps TechCrunch
p
Latest
pp
AI
pp
Amazon
pp
Apps
pp
Biotech Health
pp
Climate
pp
Cloud Computing
pp
Commerce
pp
Crypto
pp
Enterprise
pp
EVs
pp
Fintech
pp
Fundraising
pp
Gadgets
pp
Gaming
pp
Google
pp
Government Policy
pp
Hardware
pp
Instagram
pp
Layoffs
pp
Media Entertainment
pp
Meta
pp
Microsoft
pp
Privacy
pp
Robotics
pp
Security
pp
Social
pp
Space
pp
Startups
pp
TikTok
pp
Transportation
pp
Venture
pp
Events
pp
Startup Battlefield
pp
StrictlyVC
pp
Newsletters
pp
Podcasts
pp
Videos
pp
Partner Content
pp
TechCrunch Brand Studio
pp
Crunchboard
pp
Contact Us
ppThere is a whole shady industry for people who want to monitor and spy on their families Multiple app makers market their software sometimes referred to as stalkerware to jealous partners who can use these apps to access their victims phones remotely ppYet despite how sensitive this data is an increasing number of these companies are losing huge amounts of it ppAccording to TechCrunchs tally counting the latest data breach of SpyX there have been at least 25 stalkerware companies since 2017 that are known to have been hacked or have leaked customers and victims data online Thats not a typo At least 25 stalkerware companies have either been hacked or had a significant data exposure in recent years And four stalkerware companies were hacked multiple times ppSpyX is the latest stalkerware provider reported this year to have been breached although the breach itself dates back to mid2024 The breach reveals that the SpyX family of apps compromised the private phone data of almost 2 million victims at the time of its breach ppThe SpyX breach comes after the data exposures of Spyzie Cocospy and Spyic surveillance operations that left messages photos call logs and other personal and sensitive data of millions of victims exposed online according to a security researcher who found a bug that allowed them to access that data ppPrior to this year there were at least four massive stalkerware hacks in 2024 The last stalkerware breach in 2024 affected Spytech a littleknown spyware maker based in Minnesota which exposed activity logs from the phones tablets and computers monitored with its spyware Before that there was a breach at mSpy one of the longestrunning stalkerware apps which exposed millions of customer support tickets that included the personal data of millions of its customers ppPreviously an unknown hacker broke into the servers of the USbased stalkerware maker pcTattletale The hacker then stole and leaked the companys internal data They also defaced pcTattletales official website with the goal of embarrassing the company The hacker referred to a recent TechCrunch article where we reported pcTattletale was used to monitor several front desk checkin computers at a US hotel chain ppAs a result of this hack leak and shame operation pcTattletale founder Bryan Fleming said he was shutting down his companyppConsumer spyware apps like SpyX Cocospy mSpy and pcTattletale are commonly referred to as stalkerware or spouseware because jealous spouses and partners use them to surreptitiously monitor and surveil their loved ones ppThese companies often explicitly market their products as solutions to catch cheating partners by encouraging illegal and unethical behavior And there have been multiple court cases journalistic investigations and surveys of domestic abuse shelters that show that online stalking and monitoring can lead to cases of realworld harm and violence ppAnd thats why hackers have repeatedly targeted some of these companiesppEva Galperin the director of cybersecurity at the Electronic Frontier Foundation and a leading researcher and activist who has investigated and fought stalkerware for years said the stalkerware industry is a soft target ppThe people who run these companies are perhaps not the most scrupulous or really concerned about the quality of their product Galperin told TechCrunchppGiven the history of stalkerware compromises that may be an understatement And because of the lack of care for protecting their own customers and consequently the personal data of tens of thousands of unwitting victims using these apps is doubly irresponsible The stalkerware customers may be breaking the law abusing their partners by illegally spying on them and on top of that putting everyones data in dangerppThe flurry of stalkerware breaches began in 2017 when a group of hackers breached the USbased RetinaX and the Thailandbased FlexiSpy back to back Those two hacks revealed that the companies had a total number of 130000 customers all over the worldppAt the time the hackers who proudly claimed responsibility for the compromises explicitly said their motivations were to expose and hopefully help destroy an industry that they consider toxic and unethicalppIm going to burn them to the ground and leave absolutely nowhere for any of them to hide one of the hackers involved then told Motherboard ppReferring to FlexiSpy the hacker added I hope theyll fall apart and fail as a company and have some time to reflect on what they did However I fear they might try and give birth to themselves again in a new form But if they do Ill be thereppDespite the hack and years of negative public attention FlexiSpy is still active today The same cannot be said about RetinaXppThe hacker who broke into RetinaX wiped its servers with the goal of hampering its operations The company bounced back and then it got hacked again a year later A couple of weeks after the second breach RetinaX announced that it was shutting down ppJust days after the second RetinaX breach hackers hit Mobistealth and Spy Master Pro stealing gigabytes of customer and business records as well as victims intercepted messages and precise GPS locations Another stalkerware vendor the Indiabased SpyHuman encountered the same fate a few months later with hackers stealing text messages and call metadata which contained logs of who called who and when ppWeeks later there was the first case of accidental data exposure rather than a hack SpyFone left an Amazonhosted S3 storage bucket unprotected online which meant anyone could see and download text messages photos audio recordings contacts location scrambled passwords and login information Facebook messages and more All that data was stolen from victims most of whom did not know they were being spied on let alone know their most sensitive personal data was also on the internet for all to see ppOther stalkerware companies that over the years have irresponsibly left customer and victims data online are Family Orbit which left 281 gigabytes of personal data online protected only by an easytofind password mSpy which leaked over 2 million customer records in 2018 Xnore which let any of its customers see the personal data of other customers targets which included chat messages GPS coordinates emails photos and more MobiiSpy which left 25000 audio recordings and 95000 images on a server accessible to anyone KidsGuard which had a misconfigured server that leaked victims content pcTattletale which prior to its hack also exposed screenshots of victims devices uploaded in real time to a website that anyone could access and Xnspy whose developers left credentials and private keys left in the apps code allowing anyone to access victims data and now Spyzie Cocospy and Spyic which left victims messages photos call logs and other personal data as well as customers email addresses exposed onlineppAs far as other stalkerware companies that actually got hacked apart from SpyX there was Copy9 which saw a hacker steal the data of all its surveillance targets including text messages and WhatsApp messages call recordings photos contacts and brows history LetMeSpy which shut down after hackers breached and wiped its servers the Brazilbased WebDetetive which also got its servers wiped and then hacked again OwnSpy which provides much of the backend software for WebDetetive also got hacked Spyhide which had a vulnerability in its code that allowed a hacker to access the backend databases and years of stolen data of around 60000 victims Oospy which was a rebrand of Spyhide shut down for a second time and the latest mSpy hack which is unrelated to the previously mentioned leak ppFinally there is TheTruthSpy a network of stalkerware apps which holds the dubious record of having been hacked or having leaked data on at least three separate occasions ppOf these 25 stalkerware companies eight have shut down according to TechCrunchs tally ppIn a first and so far unique case the Federal Trade Commission banned SpyFone and its chief executive Scott Zuckerman from operating in the surveillance industry following an earlier security lapse that exposed victims data Another stalkerware operation linked to Zuckerman called SpyTrac subsequently shut down following a TechCrunch investigation ppPhoneSpector and Highster another two companies that are not known to have been hacked also shut down after New Yorks attorney general accused the companies of explicitly encouraging customers to use their software for illegal surveillance ppBut a company closing doesnt mean its gone forever As with Spyhide and SpyFone some of the same owners and developers behind a shuttered stalkerware maker simply rebranded ppI do think that these hacks do things They do accomplish things they do put a dent in it Galperin said But if you think that if you hack a stalkerware company that they will simply shake their fists curse your name disappear in a puff of blue smoke and never be seen again that has most definitely not been the caseppWhat happens most often when you actually manage to kill a stalkerware company is that the stalkerware company comes up like mushrooms after the rain Galperin added ppThere is some good news In a report last year security firm Malwarebytes said that the use of stalkerware is declining according to its own data of customers infected with this type of software Also Galperin reports seeing an increase in negative reviews of these apps with customers or prospective customers complaining they dont work as intendedppBut Galperin said that its possible that security firms arent as good at detecting stalkerware as they used to be or stalkers have moved from softwarebased surveillance to physical surveillance enabled by AirTags and other Bluetoothenabled trackersppStalkerware does not exist in a vacuum Stalkerware is part of a whole world of techenabled abuse Galperin saidppUsing spyware to monitor your loved ones is not only unethical but also illegal in most jurisdictions as its considered unlawful surveillance ppThat is already a significant reason not to use stalkerware Then there is the issue that stalkerware makers have proven time and time again that they cannot keep data secure neither data belonging to the customers nor their victims or targetsppApart from spying on romantic partners and spouses some people use stalkerware apps to monitor their children While this type of use at least in the United States is legal it doesnt mean using stalkerware to snoop on your kids phone isnt creepy and unethical ppEven if its lawful Galperin thinks parents should not spy on their children without telling them and without their consentIf parents do inform their children and get their goahead parents should stay away from insecure and untrustworthy stalkerware apps and use parental tracking tools built into Apple phones and tablets and Android devices that are safer and operate overtlyppHeres the complete list of stalkerware companies that have been hacked or have leaked sensitive data since 2017 in chronological orderppUpdated on March 19 2025 to include SpyX as the latest breach of a stalkerware providerppIf you or someone you know needs help the National Domestic Violence Hotline 18007997233 provides 247 free confidential support to victims of domestic abuse and violence If you are in an emergency situation call 911 The Coalition Against Stalkerware has resources if you think your phone has been compromised by spywareppTopicspp
Senior Reporter Cybersecurity
pp Zelle is shutting down its app but you probably dont need to worry
pp Mark Cuban backs Skylight a TikTok alternative built on Blueskys underlying technology
pp OpenAIs new image generator is now available to all users
pp ChatGPTs new image generator is really good at faking receipts
pp Oracle under fire for its handling of separate security incidents
pp Amazon unveils Nova Act an AI agent that can control a web browser
pp China Miéville says we shouldnt blame science fiction for its bad readers
pp 2025 Yahoop
Latest
pp
AI
pp
Amazon
pp
Apps
pp
Biotech Health
pp
Climate
pp
Cloud Computing
pp
Commerce
pp
Crypto
pp
Enterprise
pp
EVs
pp
Fintech
pp
Fundraising
pp
Gadgets
pp
Gaming
pp
pp
Government Policy
pp
Hardware
pp
pp
Layoffs
pp
Media Entertainment
pp
Meta
pp
Microsoft
pp
Privacy
pp
Robotics
pp
Security
pp
Social
pp
Space
pp
Startups
pp
TikTok
pp
Transportation
pp
Venture
pp
Events
pp
Startup Battlefield
pp
StrictlyVC
pp
Newsletters
pp
Podcasts
pp
Videos
pp
Partner Content
pp
TechCrunch Brand Studio
pp
Crunchboard
pp
Contact Us
ppThere is a whole shady industry for people who want to monitor and spy on their families Multiple app makers market their software sometimes referred to as stalkerware to jealous partners who can use these apps to access their victims phones remotely ppYet despite how sensitive this data is an increasing number of these companies are losing huge amounts of it ppAccording to TechCrunchs tally counting the latest data breach of SpyX there have been at least 25 stalkerware companies since 2017 that are known to have been hacked or have leaked customers and victims data online Thats not a typo At least 25 stalkerware companies have either been hacked or had a significant data exposure in recent years And four stalkerware companies were hacked multiple times ppSpyX is the latest stalkerware provider reported this year to have been breached although the breach itself dates back to mid2024 The breach reveals that the SpyX family of apps compromised the private phone data of almost 2 million victims at the time of its breach ppThe SpyX breach comes after the data exposures of Spyzie Cocospy and Spyic surveillance operations that left messages photos call logs and other personal and sensitive data of millions of victims exposed online according to a security researcher who found a bug that allowed them to access that data ppPrior to this year there were at least four massive stalkerware hacks in 2024 The last stalkerware breach in 2024 affected Spytech a littleknown spyware maker based in Minnesota which exposed activity logs from the phones tablets and computers monitored with its spyware Before that there was a breach at mSpy one of the longestrunning stalkerware apps which exposed millions of customer support tickets that included the personal data of millions of its customers ppPreviously an unknown hacker broke into the servers of the USbased stalkerware maker pcTattletale The hacker then stole and leaked the companys internal data They also defaced pcTattletales official website with the goal of embarrassing the company The hacker referred to a recent TechCrunch article where we reported pcTattletale was used to monitor several front desk checkin computers at a US hotel chain ppAs a result of this hack leak and shame operation pcTattletale founder Bryan Fleming said he was shutting down his companyppConsumer spyware apps like SpyX Cocospy mSpy and pcTattletale are commonly referred to as stalkerware or spouseware because jealous spouses and partners use them to surreptitiously monitor and surveil their loved ones ppThese companies often explicitly market their products as solutions to catch cheating partners by encouraging illegal and unethical behavior And there have been multiple court cases journalistic investigations and surveys of domestic abuse shelters that show that online stalking and monitoring can lead to cases of realworld harm and violence ppAnd thats why hackers have repeatedly targeted some of these companiesppEva Galperin the director of cybersecurity at the Electronic Frontier Foundation and a leading researcher and activist who has investigated and fought stalkerware for years said the stalkerware industry is a soft target ppThe people who run these companies are perhaps not the most scrupulous or really concerned about the quality of their product Galperin told TechCrunchppGiven the history of stalkerware compromises that may be an understatement And because of the lack of care for protecting their own customers and consequently the personal data of tens of thousands of unwitting victims using these apps is doubly irresponsible The stalkerware customers may be breaking the law abusing their partners by illegally spying on them and on top of that putting everyones data in dangerppThe flurry of stalkerware breaches began in 2017 when a group of hackers breached the USbased RetinaX and the Thailandbased FlexiSpy back to back Those two hacks revealed that the companies had a total number of 130000 customers all over the worldppAt the time the hackers who proudly claimed responsibility for the compromises explicitly said their motivations were to expose and hopefully help destroy an industry that they consider toxic and unethicalppIm going to burn them to the ground and leave absolutely nowhere for any of them to hide one of the hackers involved then told Motherboard ppReferring to FlexiSpy the hacker added I hope theyll fall apart and fail as a company and have some time to reflect on what they did However I fear they might try and give birth to themselves again in a new form But if they do Ill be thereppDespite the hack and years of negative public attention FlexiSpy is still active today The same cannot be said about RetinaXppThe hacker who broke into RetinaX wiped its servers with the goal of hampering its operations The company bounced back and then it got hacked again a year later A couple of weeks after the second breach RetinaX announced that it was shutting down ppJust days after the second RetinaX breach hackers hit Mobistealth and Spy Master Pro stealing gigabytes of customer and business records as well as victims intercepted messages and precise GPS locations Another stalkerware vendor the Indiabased SpyHuman encountered the same fate a few months later with hackers stealing text messages and call metadata which contained logs of who called who and when ppWeeks later there was the first case of accidental data exposure rather than a hack SpyFone left an Amazonhosted S3 storage bucket unprotected online which meant anyone could see and download text messages photos audio recordings contacts location scrambled passwords and login information Facebook messages and more All that data was stolen from victims most of whom did not know they were being spied on let alone know their most sensitive personal data was also on the internet for all to see ppOther stalkerware companies that over the years have irresponsibly left customer and victims data online are Family Orbit which left 281 gigabytes of personal data online protected only by an easytofind password mSpy which leaked over 2 million customer records in 2018 Xnore which let any of its customers see the personal data of other customers targets which included chat messages GPS coordinates emails photos and more MobiiSpy which left 25000 audio recordings and 95000 images on a server accessible to anyone KidsGuard which had a misconfigured server that leaked victims content pcTattletale which prior to its hack also exposed screenshots of victims devices uploaded in real time to a website that anyone could access and Xnspy whose developers left credentials and private keys left in the apps code allowing anyone to access victims data and now Spyzie Cocospy and Spyic which left victims messages photos call logs and other personal data as well as customers email addresses exposed onlineppAs far as other stalkerware companies that actually got hacked apart from SpyX there was Copy9 which saw a hacker steal the data of all its surveillance targets including text messages and WhatsApp messages call recordings photos contacts and brows history LetMeSpy which shut down after hackers breached and wiped its servers the Brazilbased WebDetetive which also got its servers wiped and then hacked again OwnSpy which provides much of the backend software for WebDetetive also got hacked Spyhide which had a vulnerability in its code that allowed a hacker to access the backend databases and years of stolen data of around 60000 victims Oospy which was a rebrand of Spyhide shut down for a second time and the latest mSpy hack which is unrelated to the previously mentioned leak ppFinally there is TheTruthSpy a network of stalkerware apps which holds the dubious record of having been hacked or having leaked data on at least three separate occasions ppOf these 25 stalkerware companies eight have shut down according to TechCrunchs tally ppIn a first and so far unique case the Federal Trade Commission banned SpyFone and its chief executive Scott Zuckerman from operating in the surveillance industry following an earlier security lapse that exposed victims data Another stalkerware operation linked to Zuckerman called SpyTrac subsequently shut down following a TechCrunch investigation ppPhoneSpector and Highster another two companies that are not known to have been hacked also shut down after New Yorks attorney general accused the companies of explicitly encouraging customers to use their software for illegal surveillance ppBut a company closing doesnt mean its gone forever As with Spyhide and SpyFone some of the same owners and developers behind a shuttered stalkerware maker simply rebranded ppI do think that these hacks do things They do accomplish things they do put a dent in it Galperin said But if you think that if you hack a stalkerware company that they will simply shake their fists curse your name disappear in a puff of blue smoke and never be seen again that has most definitely not been the caseppWhat happens most often when you actually manage to kill a stalkerware company is that the stalkerware company comes up like mushrooms after the rain Galperin added ppThere is some good news In a report last year security firm Malwarebytes said that the use of stalkerware is declining according to its own data of customers infected with this type of software Also Galperin reports seeing an increase in negative reviews of these apps with customers or prospective customers complaining they dont work as intendedppBut Galperin said that its possible that security firms arent as good at detecting stalkerware as they used to be or stalkers have moved from softwarebased surveillance to physical surveillance enabled by AirTags and other Bluetoothenabled trackersppStalkerware does not exist in a vacuum Stalkerware is part of a whole world of techenabled abuse Galperin saidppUsing spyware to monitor your loved ones is not only unethical but also illegal in most jurisdictions as its considered unlawful surveillance ppThat is already a significant reason not to use stalkerware Then there is the issue that stalkerware makers have proven time and time again that they cannot keep data secure neither data belonging to the customers nor their victims or targetsppApart from spying on romantic partners and spouses some people use stalkerware apps to monitor their children While this type of use at least in the United States is legal it doesnt mean using stalkerware to snoop on your kids phone isnt creepy and unethical ppEven if its lawful Galperin thinks parents should not spy on their children without telling them and without their consentIf parents do inform their children and get their goahead parents should stay away from insecure and untrustworthy stalkerware apps and use parental tracking tools built into Apple phones and tablets and Android devices that are safer and operate overtlyppHeres the complete list of stalkerware companies that have been hacked or have leaked sensitive data since 2017 in chronological orderppUpdated on March 19 2025 to include SpyX as the latest breach of a stalkerware providerppIf you or someone you know needs help the National Domestic Violence Hotline 18007997233 provides 247 free confidential support to victims of domestic abuse and violence If you are in an emergency situation call 911 The Coalition Against Stalkerware has resources if you think your phone has been compromised by spywareppTopicspp
Senior Reporter Cybersecurity
pp Zelle is shutting down its app but you probably dont need to worry
pp Mark Cuban backs Skylight a TikTok alternative built on Blueskys underlying technology
pp OpenAIs new image generator is now available to all users
pp ChatGPTs new image generator is really good at faking receipts
pp Oracle under fire for its handling of separate security incidents
pp Amazon unveils Nova Act an AI agent that can control a web browser
pp China Miéville says we shouldnt blame science fiction for its bad readers
pp 2025 Yahoop
