When Stalkers Get Stalked: Half a Million Surveillance Buyers Exposed

The Watchers Get Watched

What happens when someone who profits from spying gets spied on? A hacktivist calling themselves "wikkid" just answered that question by scraping 536,000 payment records from stalkerware companies, exposing customers who paid to secretly monitor others' phones.

The leaked data reveals email addresses, payment amounts, and partial credit card information from customers of surveillance apps like uMobix, Geofinder, and Xnspy. These aren't security tools—they're apps explicitly marketed for spying on spouses and partners, often without consent.

The irony is thick: companies that make millions helping people violate privacy just had their own customers' privacy shredded by a "trivial" website bug.

The Surveillance Economy Exposed

The breach targeted Struktura, a Ukrainian company operating under the British front Ersten Group. Their portfolio reads like a stalker's wishlist: apps that harvest call records, text messages, photos, browsing history, and precise location data from infected phones.

Xnspy alone has a troubled history—in 2022, it spilled private data from tens of thousands of Android and iPhone users. Yet customers keep paying, apparently undeterred by the security risks of the very tools they use to violate others' security.

Sponsored

Advertise with Us

[email protected]

Sponsored

TechCrunch verified the breach's authenticity by testing disposable email addresses from the dataset, successfully resetting passwords on real accounts. The vulnerability was so basic that transaction data could be retrieved from checkout pages without authentication.

The Bigger Picture: Digital Surveillance Goes Mainstream

This isn't an isolated incident. Dozens of stalkerware companies have suffered breaches in recent years, creating a perverse cycle where surveillance tools become surveillance victims.

But here's what makes this different: the scale suggests domestic surveillance has become a mainstream consumer product. Half a million payment records represent real people who decided monitoring someone else was worth their credit card number.

The customers span the spectrum—from suspicious partners to controlling parents to potentially more sinister actors. What unites them is the willingness to pay for digital stalking capabilities that would have required professional equipment just a decade ago.

The Regulatory Blind Spot

While lawmakers debate AI regulation and social media oversight, the stalkerware industry operates in a legal gray zone. These apps are illegal when used without consent, yet they're marketed openly with winking disclaimers about "employee monitoring" and "parental controls."

The companies behind them use shell corporations and international jurisdictions to avoid accountability. Struktura operates from Ukraine while presenting as British Ersten Group—a common pattern that makes enforcement nearly impossible.

Meanwhile, app stores play whack-a-mole with these tools, banning them only to see new versions appear under different names. The fundamental business model—monetizing privacy violations—remains untouched.