Loading story…
A significant data breach at RemoteCOM, a provider of surveillance and monitoring software for the US criminal justice system, has resulted in the exposure of highly sensitive personal information belonging to nearly 14,000 individuals under court supervision. The breach, attributed to a hacker known as "wikkid," targeted RemoteCOM's proprietary SCOUT software, which is widely used by law enforcement agencies across 49 US states to monitor pretrial, probation, and parole clients. SCOUT operates as a comprehensive surveillance tool, recording keystrokes, capturing screenshots, tracking locations, and sending alerts based on specific keywords typed by monitored individuals. The leaked data was split into two main files: one containing detailed records of monitored clients, and another listing thousands of criminal justice employees who used RemoteCOM's services. The "clients" file included names, home addresses, phone numbers, email addresses, IP addresses, and specific charges or offenses, ranging from sex offenses and narcotics to terrorism, stalking, and hacking. The "officers" file exposed the names, work addresses, phone numbers, email addresses, unique IDs, and job titles of nearly 7,000 criminal justice professionals. The breach has raised concerns about the security of surveillance data, especially given the sensitive nature of the information and the potential risks to both monitored individuals and law enforcement personnel. Some records labeled clients as "tech savvy," and the data also revealed the financial burden placed on offenders, with installation and recurring monitoring fees for each device. The exposure of such detailed information could lead to threats, harassment, or violence against both clients and officers, particularly as some clients may not have been convicted but were merely under investigation or awaiting trial. The hacker described the breach as "one of the easiest" they had ever carried out, highlighting possible weaknesses in RemoteCOM's security posture. The incident has prompted calls for greater scrutiny of surveillance technology vendors and the protection of sensitive data managed by third-party providers. The leak also underscores the broader risks associated with the use of aggressive spyware-like tools in the criminal justice system. Law enforcement agencies and affected individuals now face heightened risks of doxxing, identity theft, and targeted attacks. The breach has sparked debate about the ethics and oversight of digital monitoring in the justice system, as well as the responsibilities of vendors handling such critical data. Security experts warn that the fallout from this breach could be long-lasting, with the potential for further exploitation of the leaked information by malicious actors. The incident serves as a stark reminder of the need for robust cybersecurity measures in organizations handling sensitive personal and law enforcement data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A breach at U.S. surveillance provider RemoteCOM exposed sensitive data tied to court records and surveillance operations, reportedly affecting information connected to sex offenders, suspected terrorists, and drug dealers. The incident became public through reporting in late September 2025.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Italian surveillance vendor **Hacking Team** was breached and roughly **400GB** of internal data was dumped online, exposing source code, emails, customer records, and exploit details tied to its **Remote Control System (RCS)** spyware platform. Researchers reviewing the leak found multiple offensive capabilities, including an unpatched **Adobe Flash** remote code execution flaw later tracked as a major zero-day risk, alongside other exploits targeting Flash and Windows. The leaked material also showed Hacking Team had developed techniques to compromise targets using tools such as the **Tor Browser**, while the company told customers it expected their surveillance operations to resume soon despite the breach. The documents triggered broad scrutiny of Hacking Team’s business with government agencies worldwide, including reported sales or support tied to **Sudan, Ethiopia, Russia, Mexico, South Korea, and Serbia**, as well as numerous other police, intelligence, and security bodies. Reporting on the leak linked the company to clients accused of domestic spying, election-related surveillance, and monitoring journalists and dissidents, including South Korea’s NIS and multiple Mexican agencies. The fallout reached Hacking Team’s Western customers as well, with the **DEA** canceling its contract, while critics argued the records showed the company had supplied intrusive spyware to agencies associated with repression and possible export-control violations.
Jun 29, 2026
DocketWise, an Austin-based provider of cloud case management and CRM software for immigration law firms, disclosed a data breach after attackers gained unauthorized access to a third-party partner repository and used valid credentials to clone repositories tied to a data migration pipeline for the DocketWise application. The company said it detected the activity in October and later reported that the incident affected at least **143,480 individuals**, while earlier public reporting had put the impact at roughly **116,000** people. The exposed information included names and highly sensitive personal data such as **Social Security numbers**, dates of birth, driver's license and passport numbers, bank account details, tax identifiers, health insurance and medical information, and non-financial account credentials. DocketWise said forensic investigators found no evidence of ongoing unauthorized access, dark web publication, or extortion linked to the stolen data, and the company reported the incident to the FBI while offering affected individuals two years of identity protection and credit monitoring services.
Jun 29, 2026
The extortion group **ExfilSquad** claimed responsibility for breaching the U.K. Police National Legal Database (PNLD), a system managed by West Yorkshire Police, and publishing stolen data on the dark web. PNLD said the incident exposed names, organizations, and work email addresses of police officers, staff, criminal justice professionals, government partners, customers, and some users of the **Ask the Police** service. The group said it stole **1.9GB** of data covering roughly **135,000 records**, while PNLD said it had found no evidence that passwords or other security credentials were compromised and that the database does not hold confidential information on victims, witnesses, or offenders. Authorities said specialist cybersecurity organizations and the **UK National Crime Agency** were involved in the investigation and response. The breach has become a high-profile example of ExfilSquad’s broader hack-and-leak campaign, which targets exposed or misconfigured cloud and SaaS platforms including **Microsoft Dataverse**, **Power Pages**, case management systems, and CRM environments. Researchers said the group recently named **13 additional victims** across the United States, United Kingdom, and Sweden, and has shifted to **torrent-based distribution** of stolen data, using unique trackers and web seeds to make takedowns harder and accelerate spread through P2P networks. Reporting also linked active sharing nodes in **China** and **Russia** to the leaked PNLD data, underscoring the heightened risk of spear-phishing and social engineering against affected police and justice personnel.
Aug 15, 2026