A significant data breach at SpyX, a consumer-grade stalkerware operation, has affected nearly 2 million individuals, including thousands of Apple users. The breach, which occurred in June 2024, was recently discovered and had not been previously disclosed to affected parties. The incident follows a concerning pattern of stalkerware breaches, including the 2023 Spyzie breach that exposed over 500,000 users’ data.
The breach compromised records of approximately 1.97 million unique account holders with associated email addresses. Analysis revealed that about 40 percent of these email addresses were already listed in the data breach notification service Have I Been Pwned. Additionally, the breach exposed approximately 17,000 distinct sets of plaintext Apple Account usernames and passwords, raising significant security concerns at a time when Apple has been actively promoting passwordless authentication solutions to enhance account security.
“The vast majority of the email addresses are associated with SpyX,” said Troy Hunt, who operates Have I Been Pwned. “The cache also includes less than 300,000 email addresses associated with two near-identical clones of the SpyX app called MSafely and SpyPhone.”
The compromised data originated from SpyX and two similar applications, MSafely and SpyPhone. These stalkerware applications typically require physical access to a target device for installation on Android systems, which involves modifying security settings. For Apple devices, the software generally accesses device backups stored in iCloud using cloud storage credentials. The breach is particularly concerning given the recent similar security incidents affecting other surveillance applications like Cocospy and Spyic.
Prior to public disclosure, Troy Hunt provided the list of compromised iCloud credentials to Apple to help mitigate potential risks to affected users. Apple has not issued public comment regarding the incident. The operators of SpyX have not notified their customers or individuals targeted by the spyware about the data breach.
The National Domestic Violence Hotline (1-800-799-7233) provides 24/7 free, confidential support for individuals affected by domestic abuse. The Coalition Against Stalkerware offers additional resources for those who suspect their devices may be compromised by spyware.
Sources: TechCrunch, TechCrunch, Ground News
Follow Us