Hacktivist scrapes over 500,000 stalkerware customers’ payment records

An unidentified hacktivist leaked the personal payment records of more than 500,000 customers who purchased phone surveillance and social media snooping software, commonly referred to as 'stalkerware,' on a public hacking forum earlier this week. The massive data dump originated from several interconnected monitoring services and was shared to expose the identities of individuals who pay to secretly track the private communications and physical locations of others. This breach provides a rare and significant glimpse into the consumer base of the controversial surveillance industry, which has long been criticized by privacy advocates for facilitating domestic abuse and harassment. The leaked database consists of sensitive information, including user email addresses, timestamps of purchases, and partial payment card numbers. While the full financial details were not disclosed, the exposure of email addresses is particularly damaging as it links real-world identities to the use of invasive tools designed to intercept text messages, record calls, and track GPS coordinates without the victim's consent. Security researchers note that the scale of this leak highlights the surprising popularity of these 'gray-ware' applications, which often market themselves as parental control tools to bypass app store restrictions while explicitly targeting suspicious spouses. This incident adds to a growing list of security failures within the stalkerware industry, which is notorious for poor data protection practices. Because these apps require deep access to a target's operating system, they often collect massive amounts of sensitive data from the victims as well; however, this specific leak focuses on the perpetrators—the paying customers. Organizations like the Coalition Against Stalkerware have frequently warned that the companies selling these services are often as insecure as they are unethical, leaving both the stalkers and their victims vulnerable to third-party data breaches and extortion.