By 
Android-based phone monitoring app LetMeSpy has disclosed a security breach that allowed an unauthorized third-party to steal sensitive data associated with thousands of Android users.
As a result of the attack which took place on June 21st, the criminals gained access to email addresses, telephone numbers and the content of messages collected on accounts.
LetMeSpy on being aware of the attack notified law enforcement and data protection authorities. It has also taken steps to suspend all account-related functions until further notice. The identity of the threat actor and their motives are currently unknown.
LetMeSpy which is created by a Polish company named Radeal, is offered as a monthly subscription ($6 for Standard or $12 for Pro), allowing its customers to snoop on others simply by installing the software on their devices.
The app has numerous features such as to collect call logs, SMS messages, and geolocations, all of which can be accessed from the website.
The phone-tracking app has been designed to be hidden from the home screen of a phone to remain undetected. It was created for and marketed toward parents to control the phone usage of minors and for employers to monitor employees.
As of January 2023, the stalkerware app has been used to track 236,322 phones across the world, harvesting over 63.5 million text messages, 39.7 million call logs, and 43.2 million locations.
The data breach which was first reported by Polish security research blog Niebezpiecznik, analyzed a dump of the stolen data.
The database contained current records on at least 13,000 compromised devices, including detailed phone records, though some of the devices shared little to no data with LetMeSpy. The data includes about 26,000 email addresses, 16,000 SMS messages, and a database of victims' locations.
