An American spyware maker called Spytech has been hacked, leaving sensitive data of thousands of victims leaked online
A report from TechCrunchwho saw the stolen data and confirmed its authenticity, notes that an unidentified person “with knowledge of the breach” contacted the publication and shared an unencrypted cache of files taken from the company’s servers.
The files contain detailed logs of device activity from the endpoints monitored by the spyware, including the location of each individual device.
Overwhelmed
TechCrunch checked the files with offline tools and concluded that more than 10,000 devices may have been hacked.
The majority of mobile-only victims are located in Europe and the United States, with notable “enclaves” of victims in Africa, Asia, and Australia and the Middle East. The good news is that there wasn’t enough personally identifiable information to tie the data to actual individuals.
This also means that the publication has not been able to notify the affected individuals, but it has contacted the company’s Chief Executive Officer (CEO), Nathan Polencheck, who was taken aback by the news and said that this was “the first time I’ve heard of the breach and I haven’t seen the data that you’ve seen, so at this point all I can say is that I’m looking into it and will take the appropriate action.”
Spytech operates two spyware apps: Realtime-Spy and SpyAgent. The majority of infected endpoints are Windows devices, with Androids, Macs, and Chromebooks being compromised to a lesser extent.
Spyware, often referred to as spouseware, are commercial apps that advertise themselves as a way to monitor children, employees, and romantic partners. However, because they remain hidden on the device they are installed on, people often install them without the victim’s knowledge or consent, which is both illegal and unethical.
