For 2nd Time in 3 Years, Mobile Spyware Maker mSpy Leaks Millions of Sensitive Records
Summary: mSpy, a spyware-as-a-service product with more than a million claimed paying customers, left an unauthenticated database online containing millions of records, including customer usernames, passwords and private encryption keys, plus call logs, texts, contacts, notes, location data, iCloud credentials and WhatsApp and Facebook messages pulled from monitored phones. Researcher Nitish Shah found the database and was blocked by mSpy's live support when he asked for a security contact; KrebsOnSecurity alerted the company on Aug. 30 and the database was taken offline within about 12 hours.
What you should know: This is the second mSpy leak in three years, and the exposed private keys and iCloud tokens would have let anyone track and view the devices being monitored - meaning the people who installed the spyware, and the people it was installed on, were both exposed.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026