mSpy Data Breach Exposes 2.4 M User Accounts, Including Photos and Financial Screenshots
What Happened – In June 2024 hacktivists obtained and published a 318 GB data set from spyware vendor mSpy. The dump contains 2,394,179 unique records – email addresses, IP addresses, names, photos, support tickets, and over half a million attachments that include screen‑grabs of financial transactions, credit‑card images and nude selfies.
Why It Matters for Trust & Control Assurance
- This incident illustrates the risk of insufficient vendor oversight – a breach of a third‑party service that stores sensitive personal data.
- Continuous control‑assurance programs require documented evidence that vendors implement strong data‑protection, monitoring, and incident‑response controls.
- Mapping this breach to the control objective “Ensure third‑party services are regularly assessed for security posture and have auditable safeguards” helps demonstrate due‑diligence across multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Consumers of mobile‑device monitoring tools, technology‑SaaS providers, and any organization that integrates mSpy’s SDK or services into its products.
Recommended Actions
- Initiate a third‑party risk review of mSpy (or any similar surveillance vendor) and verify contractual security clauses.
- Collect and preserve evidence of vendor assessments, data‑handling policies, and incident‑response plans for audit readiness.
- Update your own incident‑response playbook to include potential compromise of third‑party data stores.
Technical Notes – The breach appears to be the result of a direct compromise of mSpy’s internal systems; the exact attack vector was not disclosed. Exfiltrated data includes email addresses, IP addresses, personal names, photographs, and attachment files containing financial and intimate images. Source: Have I Been Pwned – mSpy breach