There is a complete shady trade for individuals who wish to monitor and spy on their households. Multiple app makers market their software program — typically known as stalkerware — to jealous companions who can use these apps to entry their victims’ telephones remotely.
Yet, regardless of how delicate this knowledge is, an growing variety of these firms are dropping enormous quantities of it.
According to TechCrunch’s tally, counting the most recent knowledge breach of SpyX, there have been at the least 25 stalkerware firms since 2017 which are identified to have been hacked, or leaked buyer and victims’ knowledge on-line. That’s not a typo: At least 25 stalkerware firms have both been hacked or had a big knowledge publicity lately. And 4 stalkerware firms had been hacked a number of instances.
SpyX is the most recent stalkerware supplier reported this yr to have been breached, though the breach itself dates again to mid-2024. The breach reveals that the SpyX household of apps compromised the non-public cellphone knowledge of just about two million victims on the time of its breach.
The SpyX breach comes after the info exposures of Spyzie, Cocospy, and Spyic surveillance operations that left messages, images, name logs, and different private and delicate knowledge of hundreds of thousands of victims uncovered on-line, in response to a safety researcher who discovered a bug that allowed them to entry that knowledge.
Prior to this yr, there have been at the least 4 large stalkerware hacks in 2024. The final stalkerware breach in 2024 affected Spytech, a little-known adware maker based mostly in Minnesota, which uncovered exercise logs from the telephones, tablets, and computer systems monitored with its adware. Before that, there was a breach at mSpy, one of many longest-running stalkerware apps, which uncovered hundreds of thousands of buyer help tickets, which included the private knowledge of hundreds of thousands of its prospects.
Previously, an unknown hacker broke into the servers of the U.S.-based stalkerware maker pcTattletale. The hacker then stole and leaked the corporate’s inner knowledge. They additionally defaced pcTattletale’s official web site with the purpose of embarrassing the corporate. The hacker referred to a current TechCrunch article the place we reported pcTattletale was used to watch a number of entrance desk check-in computer systems at a U.S. lodge chain.
As a results of this hack, leak and disgrace operation, pcTattletale founder Bryan Fleming stated he was shutting down his firm.
Consumer adware apps like SpyX, Cocospy, mSpy and pcTattletale are generally known as “stalkerware” (or spouseware) as a result of jealous spouses and companions use them to surreptitiously monitor and surveil their family members.
These firms typically explicitly market their merchandise as options to catch dishonest companions by encouraging unlawful and unethical habits. And there have been a number of court docket instances, journalistic investigations and surveys of home abuse shelters that present that on-line stalking and monitoring can result in instances of real-world hurt and violence.
And that’s why hackers have repeatedly focused a few of these firms.
Eva Galperin, the director of cybersecurity on the Electronic Frontier Foundation and a number one researcher and activist who has investigated and fought stalkerware for years, stated the stalkerware trade is a “tender goal.”
“The individuals who run these firms are maybe not essentially the most scrupulous or actually involved in regards to the high quality of their product,” Galperin informed TechCrunch.
Given the historical past of stalkerware compromises, which may be an understatement. And due to the shortage of care for shielding their very own prospects — and consequently the private knowledge of tens of hundreds of unwitting victims — utilizing these apps is doubly irresponsible. The stalkerware prospects could also be breaking the legislation, abusing their companions by illegally spying on them, and, on prime of that, placing everybody’s knowledge at risk.
A historical past of stalkerware hacks
The flurry of stalkerware breaches started in 2017 when a bunch of hackers breached the U.S.-based Retina-X and the Thailand-based FlexiSpy again to again. Those two hacks revealed that the businesses had a complete variety of 130,000 prospects all around the world.
At the time, the hackers who — proudly — claimed duty for the compromises explicitly stated their motivations had been to reveal and hopefully assist destroy an trade that they take into account poisonous and unethical.
“I’m going to burn them to the bottom, and go away completely nowhere for any of them to cover,” one of many hackers concerned then informed Motherboard.
Referring to FlexiSpy, the hacker added: “I hope they’ll disintegrate and fail as an organization, and have a while to replicate on what they did. However, I concern they could try to give start to themselves once more in a brand new kind. But in the event that they do, I’ll be there.”
Despite the hack, and years of adverse public consideration, FlexiSpy continues to be lively at present. The similar can’t be stated about Retina-X.
The hacker who broke into Retina-X wiped its servers with the purpose of hampering its operations. The firm bounced again — after which it acquired hacked once more a yr later. A few weeks after the second breach, Retina-X introduced that it was shutting down.
Just days after the second Retina-X breach, hackers hit Mobistealth and Spy Master Pro, stealing gigabytes of buyer and enterprise information, in addition to victims’ intercepted messages and exact Global Positioning System places. Another stalkerware vendor, the India-based SpyHuman, encountered the identical destiny just a few months later, with hackers stealing textual content messages and name metadata, which contained logs of who referred to as who and when.
Weeks later, there was the primary case of unintentional knowledge publicity, fairly than a hack. SpyFone left an Amazon-hosted S3 storage bucket unprotected on-line, which meant anybody may see and obtain textual content messages, images, audio recordings, contacts, location, scrambled passwords and login info, Facebook messages and extra. All that knowledge was stolen from victims, most of whom didn’t know they had been being spied on, not to mention know their most delicate private knowledge was additionally on the web for all to see.
Other stalkerware firms that over time have irresponsibly left buyer and victims’ knowledge on-line are FamilyOrbit, which left 281 gigabytes of private knowledge on-line protected solely by an easy-to-find password; mSpy, which leaked over 2 million buyer information in 2018; Xnore, which let any of its prospects see the private knowledge of different prospects’ targets, which included chat messages, Global Positioning System coordinates, emails, images and extra; MobiiSpy, which left 25,000 audio recordings and 95,000 photos on a server accessible to anybody; KidsGuard, which had a misconfigured server that leaked victims’ content material; pcTattletale, which previous to its hack additionally uncovered screenshots of victims’ units uploaded in actual time to an internet site that anybody may entry; and Xnspy, whose builders left credentials and personal keys left within the apps’ code, permitting anybody to entry victims’ knowledge; and now Spyzie, Cocospy and Spyic, which left victims’ messages, images, name logs, and different private knowledge, in addition to prospects’ e-mail addresses, uncovered on-line.
As far as different stalkerware firms that really acquired hacked, other than SpyX, there was Copy9, which noticed a hacker steal the info of all its surveillance targets, together with textual content messages and WhatsApp messages, name recordings, images, contacts, and brows historical past; LetMeSpy, which shut down after hackers breached and wiped its servers; the Brazil-based WebDetetive, which additionally acquired its servers wiped, after which hacked once more; PersonalSpy, which supplies a lot of the back-end software program for WebDetetive, additionally acquired hacked; Spyhide, which had a vulnerability in its code that allowed a hacker to entry the back-end databases and years of stolen round 60,000 victims’ knowledge; Oospy, which was a rebrand of Spyhide, shut down for a second time; and the most recent mSpy hack, which is unrelated to the beforehand talked about leak.
Finally there may be TheRealitySpy, a community of stalkerware apps, which holds the doubtful file of getting been hacked or having leaked knowledge on at the least three separate events.
Hacked, however unrepented
Of these 25 stalkerware firms, eight have shut down, in response to TechCrunch’s tally.
In a primary and to date distinctive case, the Federal Trade Commission banned SpyFone and its chief government, Scott Zuckerman, from working within the surveillance trade following an earlier safety lapse that uncovered victims’ knowledge. Another stalkerware operation linked to Zuckerman, referred to as SpyTrac, subsequently shut down following a TechCrunch investigation.
PhoneSpector and Highster, one other two firms that aren’t identified to have been hacked, additionally shut down after New York’s legal professional common accused the businesses of explicitly encouraging prospects to make use of their software program for unlawful surveillance.
But an organization closing doesn’t imply it’s gone ceaselessly. As with Spyhide and SpyFone, among the similar homeowners and builders behind a shuttered stalkerware maker merely rebranded.
“I do assume that these hacks do issues. They do accomplish issues, they do put a dent in it,” Galperin stated. “But should you assume that should you hack a stalkerware firm, that they’ll merely shake their fists, curse your title, disappear in a puff of blue smoke and by no means be seen once more, that has most positively not been the case.”
“What occurs most frequently, if you really handle to kill a stalkerware firm, is that the stalkerware firm comes up like mushrooms after the rain,” Galperin added.
There is a few excellent news. In a report final yr, safety agency Malwarebytes stated that using stalkerware is declining, in response to its personal knowledge of shoppers contaminated with this sort of software program. Also, Galperin experiences seeing a rise in adverse evaluations of those apps, with prospects or potential prospects complaining they don’t work as supposed.
But, Galperin stated that it’s attainable that safety corporations aren’t nearly as good at detecting stalkerware as they was once, or stalkers have moved from software-based surveillance to bodily surveillance enabled by AirTags and different Bluetooth-enabled trackers.
“Stalkerware doesn’t exist in a vacuum. Stalkerware is an element of a complete world of tech-enabled abuse,” Galperin stated.
Say no to stalkerware
Using adware to watch your family members is just not solely unethical, it’s additionally unlawful in most jurisdictions, because it’s thought of illegal surveillance.
That is already a big motive to not use stalkerware. Then there may be the difficulty that stalkerware makers have confirmed time and time once more that they can not maintain knowledge safe — neither knowledge belonging to the purchasers nor their victims or targets.
Apart from spying on romantic companions and spouses, some individuals use stalkerware apps to watch their youngsters. While this sort of use, at the least within the United States, is authorized, it doesn’t imply utilizing stalkerware to snoop in your children’ cellphone isn’t creepy and unethical.
Even if it’s lawful, Galperin thinks mother and father shouldn’t spy on their youngsters with out telling them, and with out their consent.
If mother and father do inform their youngsters and get their go-ahead, mother and father ought to steer clear of insecure and untrustworthy stalkerware apps, and use parental monitoring instruments constructed into Apple telephones and tablets and Android units which are safer and function overtly.
Recap of breaches and leaks
Here’s the entire checklist of stalkerware firms which have been hacked or have leaked delicate knowledge since 2017, in chronological order:
Updated on March 19, 2025, to incorporate SpyX as the most recent breach of a stalkerware supplier.
If you or somebody you recognize wants assist, the National Domestic Violence Hotline (1-800-799-7233) supplies 24/7 free, confidential help to victims of home abuse and violence. If you might be in an emergency scenario, name 911. The Coalition Against Stalkerware has assets should you assume your cellphone has been compromised by adware.
