mSpy (2024) data breach: 2.4M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2024-07-11
In June 2024, a huge trove of data from spyware maker mSpy was obtained by hacktivists and published online. Comprising of 142GB of user data and support tickets along with 176GB of more than half a million attachments, the data contained 2.4M unique email addresses, IP addresses names and photos. The data was predominantly support tickets seeking help to install the spyware on target devices, whilst the attachments contained various data including screen grans of financial transactions, photos of credit cards and nude selfies. Exposed data: email addresses, ip addresses, names, photos. The breach dates from Jun 9, 2024; Have I Been Pwned loaded it on Jul 11, 2024.
What to do
- If you had a mSpy (2024) account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch