Breach And Scope Of Data
A hacktivist has scraped more than half a million payment records from a provider of consumer-grade phone surveillance apps, exposing customer email addresses and partial payment details of people who paid to monitor others. The dataset includes transactions tied to services such as Geofinder and uMobix, and to Peekviewer, formerly known as Glassagram, which claims to provide access to private Instagram accounts. The apps are sold by a Ukrainian company called Struktura, and the records also include transactions for Xnspy, a surveillance app that in 2022 exposed private data from tens of thousands of Android devices and iPhones.
The data reviewed by TechCrunch contains about 536,000 lines with customer email addresses, the app or brand purchased, the amount paid, the payment card type, and the last four digits of the card. The records do not include payment dates.
Verification Of The Leak
TechCrunch verified the dataset by using several entries that listed disposable email addresses with public inboxes, such as Mailinator, and initiating password resets through the surveillance apps’ account portals. Resetting those accounts showed that the records corresponded to real users. The outlet also matched unique invoice numbers from the dataset with the vendor’s checkout pages, which returned the same customer and transaction details without requiring a password.
The hacktivist, who uses the name “wikkid,” said the data was scraped by exploiting what they described as a trivial bug in the vendor’s website and said they target apps used for spying. The data was later posted to a known hacking forum.
Companies And Branding
The forum listing names the surveillance vendor as Ersten Group, which presents itself as a U.K.-based software startup. TechCrunch found multiple email addresses in the dataset used for testing and customer support that reference Struktura, a Ukrainian company with a website that mirrors Ersten Group’s. The earliest record in the dataset includes the email address of Struktura’s chief executive, Viktoriia Zosim, for a $1 transaction.
Stalkerware Risks And Past Incidents
Over recent years, dozens of stalkerware services have been hacked or have exposed private data because of weak security practices, often affecting the people being monitored. Apps such as uMobix and Xnspy, once installed on a phone, upload call logs, messages, photos, browsing history, and location data to be viewed by the person who planted the software. These services have been marketed for spying on spouses and partners, which is illegal.
Featured image credits: needpix.com
For more stories like it, click the +Follow button at the top of this page to follow us.