Massive data breach hits Ukrainian surveillance software company mSpy

Ukrainian surveillance software firm mSpy experienced a significant data breach last month, compromising millions of customer email addresses, support correspondence, and user data. The data leak, reported by Have I Been Pwned (HIBP), totals over 300GB, including 142GB of user data and 176GB of attachments. Among the exposed information are more than 2.4 million email addresses, IP addresses, names, nude photos, credit card images, financial transaction data, and records of customer interactions with mSpy’s Zendesk support team.

The breach revealed that some US government officials, employees, and military personnel were among mSpy’s users or potential customers. TechCrunch reported that the leaked data included details of "several senior-ranking military personnel," an active federal appeals court judge, and a county sheriff’s office. A federal court representative stated that the judge used mSpy exclusively for a family matter.

mSpy’s software is marketed as a tool for parents or individuals to secretly monitor phone behavior, allowing users to track keystrokes, review text messages, monitor locations, examine social media accounts, and access sent and received photos. Despite the massive leak, the exposed customer service tickets represent only a portion of mSpy’s total user base.

Cybersecurity firm MalwareBytes has labeled mSpy a "dangerous monitoring tool" and a form of "stalkerware" due to its capability to surveil users without their consent. The firm criticized spyware companies for often being lax with their security measures. This incident is not the first for mSpy; a previous breach in 2015 affected nearly 700,000 users, according to HIBP.