Breachesby GlyphCatwatchful
Disclosed Jul 2, 202561,641 accountsUnverified
Catwatchful stalkerware bug spills customer logins and victims' data
A researcher found a flaw in Android stalkerware Catwatchful that exposed its full database of customer email addresses and plaintext passwords; the app, hosted on Google Firebase, uploaded victims' photos, messages and locations.
What is known
| People affected | 61,641 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Jul 2, 2025 |
| Happened | Jun 9, 2025 |
| Attack | Exposed data |
| Data exposed | EmailsPasswordsMessagesLocationOther |
| Sector | Tech |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Check your email | Have I Been Pwned |
Sources
Notices filed
History of this record
aggregator to pressby seedSource
https://haveibeenpwned.com/Breach/Catwatchful to https://techcrunch.com/2025/07/02/data-breach-reveals-catwatchful-stalkerware-spying-on-thousands-android-phones/by seedSource
unknown to misconfigurationby seedSource
["emails","passwords"] to ["emails","passwords","messages","location","other"]by seedSource
2025-07-03 to 2025-07-02by seedSource
In June 2025, spyware maker Catwatchful suffered a data breach that exposed over 60k customer records . The breach was due to a SQL injection vulnerability that enabled email addresses and plain text passwords to be extracted from the syste to A researcher found a flaw in Android stalkerware Catwatchful that exposed its full database of customer email addresses and plaintext passwords; the app, hosted on Google Firebase, uploaded victims' photos, messages and locations.by seedSource
empty to Catwatchful stalkerware bug spills customer logins and victims' databy seedSource
First recordedby backfillSource
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.