On June 24, 2024, SpyX, a commercial spyware vendor, appeared in a fresh dataset on Have I Been Pwned containing records for nearly 2 million unique email addresses. The breach also exposed IP addresses, countries of residence, device information, 6-digit PINs stored in password fields, and a set of iCloud credentials that included target email addresses paired with plaintext Apple passwords. If you or anyone in your household has ever been monitored through SpyX or used an email address that ended up in one of its customer databases, your information is now publicly available.
Named in this incident?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch SpyX
Get alerted the next time SpyX files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about SpyX’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details from the Breach
The primary disclosure on Have I Been Pwned states that the dataset contains 2.0M unique email addresses along with device information, geographic locations, IP addresses, and passwords. The password field in many records contains 6-digit PINs rather than traditional alphanumeric passwords. A separate collection of iCloud credentials was also exposed; these appear to be login details the spyware’s customers used to connect directly to victims’ Apple accounts. The listing does not specify exactly when the breach occurred or how the data was initially taken, only that the records surfaced in June 2024.
Why This Matters for You and Your Family
Device information, IP addresses, and geographic locations can be combined to identify exactly who was being watched and from where. If your email address appears in the dump, anyone with access to the dataset now knows that you or a family member were once a target of commercial spyware. The presence of plaintext Apple passwords tied to iCloud credentials is especially dangerous because it allows direct access to photos, messages, location history, and connected devices. For parents, this risk extends to children whose devices may have been monitored through the same customer accounts. Even if you were not the intended target, the exposure of these records creates permanent residual risk because the data can be resold or repurposed indefinitely.
Doxxing and Identity-Chain Implications
Once an email and password pair leaks, attackers can test those credentials across other services, quickly mapping additional accounts that link back to your real identity. IP addresses and location data further tighten the chain, allowing someone to correlate your online handles, gaming usernames, and family member profiles. This is precisely how doxxing campaigns escalate: a single breach provides the seed data that attackers use to pull together addresses, phone numbers, and relationships. Credential leaks like this one frequently cascade into account takeovers on gaming platforms, social media, and email, exposing children’s accounts that often reuse simplified passwords or share recovery emails with parents.