Loading story…
The consumer spyware services Cocospy and Spyzie suffered breaches that exposed large volumes of customer data and reportedly opened access to highly sensitive information collected from monitored devices. According to breach disclosures added to Have I Been Pwned, the Cocospy incident exposed nearly 1.8 million customer email addresses, while the Spyzie breach exposed about 519,000 email addresses; related spyware service Spyic was also reported as affected.
The compromised data reportedly included not only customer records but also victim information gathered by the spyware platforms, including captured messages, photos, and call logs. Because of the sensitivity of the incident, the exposed email addresses were provided to HIBP but were classified as sensitive, meaning they are not publicly searchable through the service.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Have I Been Pwned added data from the February 2025 Spyic spyware breach, covering nearly 876,000 customer email addresses. HIBP classified the breach as sensitive, citing reports that the incident also exposed highly sensitive victim data such as messages, photos, and call logs.
Following the breaches, datasets containing nearly 1.8 million Cocospy customer email addresses and about 519,000 Spyzie customer email addresses were provided to Have I Been Pwned. HIBP classified the incidents as sensitive, so the exposed records were not made publicly searchable.
In February 2025, the spyware services Cocospy and Spyzie were breached, with reporting indicating the related service Spyic was also affected. The incidents exposed customer email addresses and reportedly enabled unauthorized access to sensitive victim data including messages, photos, and call logs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two large spam-related datasets, **Special K Data Feed** and **SC Daily Phone**, were added to Have I Been Pwned after exposing personal information tied to nearly 64 million identities in total. The records surfaced from 2015-era spam list activity and appear to have been compiled for use in unsolicited marketing or spam operations rather than from a single corporate intrusion. The exposed data in both lists included **names, physical addresses, IP addresses, genders, birth dates, and phone numbers**, creating a broad privacy risk for affected individuals. Special K Data Feed contained nearly **31 million** identities, while SC Daily Phone exposed nearly **33 million**, highlighting how large-scale spam ecosystems can aggregate and circulate detailed personally identifiable information for abuse.
Jul 12, 2026
Cybernews researchers reported multiple **data exposures caused by misconfigured back-end services**, including consumer mobile apps and a large unprotected database. Three widely downloaded Android AI photo identification apps—*Insect Identifier by Photo Cam*, *Dog Breed Identifier Photo Cam*, and *Spider Identifier App by Photo*—reportedly leaked more than **150,000** users’ data via a **Firebase misconfiguration** with inadequate authentication/access controls. Exposed data included email addresses, usernames, profile photos, notification tokens, and **GPS coordinates**; while passwords were not found, researchers noted the location data could enable stalking, doxxing, and targeted scams, and observed indications that automated bots had already discovered the exposed databases prior to the investigation. The apps were attributed to publisher **MobilMinds** (linked to **OZI Technologies**), and the developers reportedly did not respond to requests for comment. Separately, Cybernews identified an **unprotected Elasticsearch cluster** exposing approximately **8.7 billion records** associated with China, including names, birthdates, home addresses, national ID numbers, social media identifiers, usernames, and other account/platform details; the dataset also reportedly contained **plaintext credentials** and corporate/business records, suggesting long-term aggregation. The database’s ownership was not confirmed, but it was subsequently secured; researchers characterized the exposure as a systemic privacy risk potentially affecting hundreds of millions of individuals. Two additional items in the set describe individual bug-hunting writeups (e.g., bypassing mobile controls and abusing password reset/IDOR-style issues) but do not provide verifiable linkage to the specific Firebase/Elasticsearch exposures described above.
Jun 29, 2026
Have I Been Pwned (HIBP), the widely used data breach notification service, has indexed nearly 2 billion unique email addresses and 1.3 billion passwords from newly obtained datasets, marking the largest single update in the platform's history. The data, sourced in part from threat intelligence provider Synthient, includes both stealer log data—collected by malware from infected machines—and credential stuffing lists, which are typically compiled from previous breaches and used to facilitate unauthorized access to accounts across multiple services. This update brings the total number of accounts tracked by HIBP to over 15 billion, significantly expanding the visibility of exposed credentials for individuals and organizations. The newly indexed records include 183 million unique email addresses uploaded on October 21, as well as a much larger corpus totaling nearly 2 billion addresses and 1.3 billion passwords, 625 million of which were previously unseen. Users are encouraged to check their exposure using HIBP's free search tools and to take immediate action if their credentials are found, such as changing passwords and enabling multi-factor authentication. The scale and diversity of the data highlight the ongoing risks of password reuse and the importance of proactive credential management to mitigate the threat of account takeover attacks.
Jul 12, 2026