SQL Injection Breach Exposes 61,641 Email Addresses and Plain‑Text Passwords from Spyware Vendor Catwatchful
What Happened — In June 2025, Catwatchful, a provider of surveillance software, suffered a data breach. An exploitable SQL‑injection flaw in its web application allowed attackers to extract email addresses and clear‑text passwords for 61,641 user accounts.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate secure‑coding practices and the need for continuous application‑security monitoring.
- Highlights the importance of credential‑protection controls (hashed passwords, MFA) that can be documented as audit evidence.
- Provides a concrete scenario that a continuous control‑assurance program should detect, log, and remediate.
Who Is Affected — Technology/SaaS vendors that store user credentials, especially those in the surveillance or endpoint‑security space.
Recommended Actions
- Perform an immediate code review and remediate the SQL‑injection vector.
- Deploy password hashing (e.g., bcrypt, Argon2) and enforce multi‑factor authentication for all accounts.
- Enable detailed query logging and integrate alerts into a SIEM for unauthorized database access.
- Update incident‑response playbooks to include credential‑exposure scenarios and collect remediation evidence for audit readiness.
Source: Have I Been Pwned – Catwatchful breach
Technical Notes — The attack leveraged a classic SQL injection (no CVE assigned) to bypass input validation and retrieve data from the users table where passwords were stored in plain text. No encryption or hashing was applied to the credential field. Source: same as above