uMobix

Summary

A hacktivist obtained and published the payment information of more than half a million customers of the stalkerware application uMobix, citing opposition to the industry. The exposed data included names, email addresses, and transaction details, adding to a series of security failures among similar monitoring apps. Previous incidents have seen customer support tickets, call logs, messages, photos, and other personal data leaked from providers such as mSpy, Catwatchful, and others. This leak follows a pattern of repeated breaches that have compromised both subscriber information and the data of the individuals being monitored.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 9, 2026, TechCrunch reported that a hacktivist had scraped and published online the payment information of more than 500,000 customers of uMobix, a stalkerware application also associated with Geofinder and Peekviewer. The leak followed a series of earlier stalkerware incidents, including the 2025 breach of Catwatchful that exposed phone data of at least 26,000 victims. The hacktivist stated that the action was intended to target stalkerware apps, referencing prior attacks on Retina-X and FlexiSpy. The publication occurred after the hacktivist obtained the data from uMobix’s systems.

The article provides a chronological list of stalkerware companies that have been hacked or leaked data since 2017, showing uMobix as the most recent entry for 2026. Before uMobix, firms such as Cocospy, Spyic, Spyzie, and Catwatchful experienced exposures in 2025, while earlier years saw breaches of mSpy, pcTattletale, Xnspy, and others. The list indicates that at least 27 stalkerware providers have suffered such incidents, with at least four experiencing multiple breaches over the period.

The disclosure places the payment details of over half a million uMobix customers in a publicly accessible online location. This event adds to the cumulative record of stalkerware security failures documented by TechCrunch. The article does not describe any specific containment or remedial actions taken by uMobix following the leak.

Sources

Sources available to members: 1 source.