mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing the sensitive information of millions of its customers.
The breach, which Brainstack, mSpy’s parent company, has not publicly acknowledged, has raised serious concerns about spyware applications’ security and ethical implications.
The Extent of the Breach
The breach, first disclosed by Switzerland-based hacker Maia Arson Crimew, involved over 100 gigabytes of Zendesk records. These records contained millions of individual customer service tickets, email addresses, and the contents of those emails.
Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files
Techcrunch data revealed that mSpy’s customers are spread globally, with significant clusters in Europe, India, Japan, South America, the United Kingdom, and the United States.
Troy Hunt, who runs the data breach notification site Have I Been Pwned, obtained a copy of the leaked dataset. He added about 2.4 million unique email addresses of mSpy customers to his site’s catalog of past data breaches.
Hunt confirmed the accuracy of the leaked data by contacting several subscribers who verified the information.
Implications for Privacy and Security
The mSpy data breach is the latest in several incidents involving phone spyware operations. This breach underscores the inherent risks associated with spyware applications, which are often marketed for parental control but can be misused for unauthorized surveillance.
The leaked data included customer information and details of unwitting victims targeted by mSpy users.
Dataset analysis revealed that some journalists had contacted mSpy following a previous breach in 2018. Additionally, U.S. law enforcement agents had filed or sought to file subpoenas and legal demands with mSpy.
In one instance, a mSpy representative provided billing and address information about a customer to an FBI agent investigating a kidnapping and homicide case. The emails in the leaked data show that mSpy’s operators were aware of the spyware’s misuse.
After being discovered, some customers inquired about removing mSpy from their partner’s phone. The dataset also raised questions about U.S. government officials and agencies, police departments, and the judiciary using mSpy, with some instances lacking transparent legal processes.
Brainstack’s Role and Response
Brainstack, the Ukrainian tech company behind mSpy, has remained largely hidden. Despite its significant customer base, Brainstack has not publicly acknowledged the breach.
The leaked Zendesk data exposed Brainstack’s involvement in mSpy’s operations, revealing records of employees using false names to respond to customer tickets.
When contacted by TechCrunch, Brainstack employees confirmed their names as found in the leaked records but declined to discuss their work.
Brainstack’s chief executive, Volodymyr Sitnikov, and senior executive, Kateryna Yurchuk, did not respond to multiple emails requesting comment. A Brainstack representative, who did not provide their name, declined to answer questions but did not dispute the reporting.
Zendesk, the platform used by mSpy for customer support, stated that they had no evidence of a compromise of their platform. However, they did not clarify whether mSpy’s use of Zendesk violated their terms of service.
The mSpy data breach has exposed the vulnerabilities and ethical concerns surrounding spyware applications. With millions of customers’ data compromised, the incident highlights the need for stricter regulations and oversight of spyware operations.
As authorities and watchdogs continue to investigate, the breach is a stark reminder of the potential dangers of surveillance technology.
"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo