Catwatchful
Disclosed Jul 2, 20251 year ago61,641 accountsUnverified
Catwatchful stalkerware bug spills customer logins and victims' data
A researcher found a flaw in Android stalkerware Catwatchful that exposed its full database of customer email addresses and plaintext passwords; the app, hosted on Google Firebase, uploaded victims' photos, messages and locations.
What is known
| People affected | 61,641 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Jul 2, 2025 |
| Happened | Jun 9, 2025 |
| Attack | Exposed data |
| Data exposed | Emails, Passwords, Messages, Location, Other |
| Sector | Tech |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: Catwatchfulhaveibeenpwned.com · Aggregator | Aggregator |
| Data breach reveals Catwatchful stalkerware is spying on thousands of phonestechcrunch.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Jul 2, 2025 | |
| Have I Been Pwnedaccounts in the data | Jul 3, 2025 | 61,641 |
History of this record
- 2026-09-25 · source_type: aggregator to press · seed source
- 2026-09-25 · source_url: https://haveibeenpwned.com/Breach/Catwatchful to https://techcrunch.com/2025/07/02/data-breach-reveals-catwatchful-stalkerware-spying-on-thousands-android-phones/ · seed source
- 2026-09-25 · attack: unknown to misconfiguration · seed source
- 2026-09-25 · data_types: ["emails","passwords"] to ["emails","passwords","messages","location","other"] · seed source
- 2026-09-25 · disclosed: 2025-07-03 to 2025-07-02 · seed source
- 2026-09-25 · summary: In June 2025, spyware maker Catwatchful suffered a data breach that exposed over 60k customer records . The breach was due to a SQL injection vulnerability that enabled email addresses and plain text passwords to be extracted from the syste to A researcher found a flaw in Android stalkerware Catwatchful that exposed its full database of customer email addresses and plaintext passwords; the app, hosted on Google Firebase, uploaded victims' photos, messages and locations. · seed source
- 2026-09-25 · title: empty to Catwatchful stalkerware bug spills customer logins and victims' data · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.