More than 310 gigabytes of data from spyware maker mSpy, including 2.4 million unique emails, was leaked online in June, and obtained by data breach notification site Have I Been Pwned.
The data, reportedly leaked online by hacktivists, includes 142 Gb of user data such as email addresses, IP addresses, and names, obtained from support tickets filed by individuals seeking help to install the application.
An additional 176 Gb of attachments, which include screen captures of financial transactions, photos of credit cards, and selfies, was also leaked.
According to TechCrunch, some of the leaked data includes support tickets from senior-ranking US military personnel, a court judge, a county sheriff’s office, and a government department’s watchdog.
Some of the leaked email addresses apparently belong to individuals being monitored through mSpy, journalists who contacted the company, and US law enforcement filing legal demands with the company.
The information was allegedly stolen from mSpy owner Brainstack’s Zendesk customer support system in May and includes data spanning over the past decade.
A controversial mobile and computer monitoring software, mSpy is advertised as a parental control application that can be used on Android, iOS, macOS, and Windows devices to monitor and log the activity of those devices’ users.
While it’s supposed to have a legitimate purpose, the application is being used as surveillanceware (or spyware) to monitor individuals in real time, without their knowledge or consent, which is illegal.
mSpy has users worldwide and the company appears to be aware of the illicit use of the application, the leaked data shows.
The surveillance software company has suffered at least two data breaches in the past. A dataset containing information on over 400,000 mSpy users was leaked in 2015, and roughly two million mSpy records were leaked in 2018.
