Exposed Stalkerware Database Reveals Massive Privacy Breach of European Celebrity and High-Profile Associates

The digital landscape has long been plagued by the shadow of stalkerware—malicious software designed to allow individuals to covertly monitor the private lives of others. While the primary harm of these applications lies in the initial violation of a victim’s privacy by a known associate, a secondary and perhaps more catastrophic risk has emerged: the systemic insecurity of the spyware platforms themselves. This week, a significant data exposure involving nearly 90,000 sensitive files has illustrated the devastating potential of this dual-layered threat. A security researcher has uncovered a massive, unprotected cloud repository containing intimate screenshots, private messages, and financial data belonging to a prominent European celebrity, all of which appear to have been harvested via the notorious stalkerware tool known as Cocospy.

The discovery, made by Jeremiah Fowler of Black Hills Information Security, highlights a "worst-case scenario" for digital privacy. The exposed database, which was accessible to anyone with an internet connection and no requirement for authentication, contained 86,859 individual images. These files provided a granular, minute-by-minute look into the life of the victim, capturing everything from private WhatsApp and Instagram conversations to sensitive personal photographs and financial transactions. This incident serves as a stark reminder that when an individual uses spyware to target another, they are not only violating the victim’s trust but are often handing that victim’s entire digital identity over to a third-party platform with substandard security protocols.

Discovery of the Exposed Repository

Jeremiah Fowler, a seasoned security researcher known for identifying misconfigured databases, located the repository during a routine scan of open cloud storage. Unlike typical corporate data breaches involving customer lists or internal memos, this repository was deeply personal. Fowler noted that the dataset focused exclusively on a single primary target: a high-profile European celebrity whose identity is being withheld to prevent further victimization.

The repository was explicitly named after "Cocospy," a well-known brand of stalkerware that markets itself as a tool for parental monitoring or employee tracking but is frequently utilized for domestic spying. The data within the repository spanned a timeline from mid-2024 to mid-2025, suggesting a prolonged period of surveillance. Fowler’s analysis revealed that the screenshots were not just random captures but a comprehensive record of the victim’s phone usage. This included "stealth mode" captures of social media platforms including TikTok, Facebook, and Instagram, as well as encrypted messaging services like WhatsApp.

Beyond the celebrity themselves, the breach exposed a wide network of associates. The screenshots captured private interactions with models, influencers, and other high-profile individuals, some of whom command audiences of millions. The collateral damage of such a breach is immense, as every person who communicated with the primary victim effectively had their private messages and contact details uploaded to an insecure cloud server without their knowledge or consent.

The Anatomy of Cocospy and Stealth Surveillance

To understand the gravity of this breach, one must understand how Cocospy and similar stalkerware applications operate. These tools are typically installed manually on a target’s device, often by someone with physical access to the phone. Once installed, the app operates in a "stealth mode," hiding its icon from the home screen and running in the background to avoid detection by the user.

Vangelis Stykas, a security researcher and cofounder of Kumio AI, has conducted extensive technical analyses of Cocospy and its sister applications. According to Stykas, the Android version of the software is "full-blown spyware." The application is designed to exfiltrate nearly every piece of data on the device, including call logs, SMS messages, real-time GPS location, and browser history. One of its most intrusive features is the automated screenshot function, which triggers every few minutes to capture whatever is currently on the victim’s screen.

This functionality explains the nature of the 86,859 images discovered by Fowler. The screenshots captured business invoices, partial credit card numbers, personal payment details, and private, often nude, photographs. By capturing the screen itself, the spyware bypasses the security of end-to-end encrypted apps like WhatsApp or Signal. Even if the data is encrypted during transmission, it is captured visually at the point of display and then uploaded to the spyware provider’s cloud infrastructure—which, in this case, was left entirely unprotected.

A Timeline of the Data Exposure Incident

The chronology of this specific incident reflects a broader pattern of negligence within the stalkerware industry. While the exact date the repository first became public is unknown, the data contained within it provides a clear window into the duration of the surveillance.

1. Mid-2024 to Mid-2025: The period during which the data was actively being harvested from the celebrity’s device and uploaded to the Cocospy-linked repository.
2. Early 2025: Cocospy and several related apps, including Spyic and Fami360, reportedly went offline following a separate, massive security breach. That breach exposed the email addresses of millions of customers and revealed critical flaws in how the apps handled victim data.
3. Discovery Phase: Jeremiah Fowler identified the specific repository containing the celebrity’s data during a security audit. He observed that the data was stored in a cloud environment without password protection or IP whitelisting.
4. Reporting and Remediation: Upon realizing the sensitivity of the data, Fowler attempted to contact the victim. Failing to reach them directly, he notified the cloud service provider hosting the data. The provider then contacted the account owner, leading to the repository being secured and taken off the public internet.
5. Law Enforcement Involvement: Fowler has confirmed that he reported the incident to local law enforcement agencies in the victim’s jurisdiction, citing the potential for criminal stalking and the exposure of sensitive financial information.

The Concept of Secondary Victimization

One of the most troubling aspects of this breach is what security experts call "secondary victimization." The primary victim of stalkerware is the person whose device is infected. However, because the software captures two-way communications, everyone the victim interacts with becomes a secondary victim.

In the case of the European celebrity, the leaked data included the private phone numbers and personal conversations of numerous other public figures. For influencers and models whose livelihoods depend on their digital presence and personal brand, the exposure of private chats or "behind-the-scenes" business negotiations can be professionally and personally devastating. Fowler’s findings included invoices and payment details that could be used for identity theft or targeted phishing attacks against these secondary victims.

"You capture the initial victim, but you also victimize everyone they communicate with," Fowler noted in his report. This ripple effect makes stalkerware a communal threat rather than just a private dispute between two individuals.

Historical Context of Stalkerware Security Failures

The exposure of Cocospy data is not an isolated event; it is part of a systemic trend. The stalkerware industry is notoriously under-regulated and frequently prioritizes surveillance capabilities over data security. Because these companies operate in a legal gray area—often marketing themselves as "child safety" tools to circumvent app store bans—they rarely adhere to the security standards expected of mainstream technology firms.

In recent years, several major stalkerware providers have suffered catastrophic breaches:

• mSpy: One of the largest players in the industry, mSpy has suffered multiple data breaches, exposing millions of records, including passwords and private messages.
• SpyFone: In 2021, the Federal Trade Commission (FTC) banned SpyFone from the surveillance business after the company failed to secure the data it collected, leaving it accessible to hackers.
• The 2025 Cocospy Outage: As noted in the current findings, Cocospy had already faced a major shutdown earlier in 2025 due to security vulnerabilities that exposed its entire customer base.

These incidents demonstrate a fundamental truth: if a company is willing to facilitate the secret surveillance of individuals, they are unlikely to invest heavily in protecting the data they have "stolen" on behalf of their users.

Analysis of Global Stalkerware Trends and Legal Repercussions

The rise of stalkerware has prompted a global response from both the tech industry and lawmakers. The "Coalition Against Stalkerware," a group of security firms and domestic violence advocacy organizations, has worked to improve the detection of these apps by antivirus software. However, as the Cocospy incident shows, detection is only half the battle.

From a legal perspective, the use of stalkerware is increasingly being prosecuted as a criminal offense. In many European jurisdictions, the unauthorized installation of such software constitutes a violation of computer misuse laws and privacy statutes. When a breach occurs, the platform providers may also face significant fines under the General Data Protection Regulation (GDPR) for failing to implement "privacy by design" and "privacy by default."

The fact that this specific breach involved a celebrity adds a layer of complexity. Public figures are frequent targets for hackers and stalkers, yet as Fowler emphasized, "Even public people deserve privacy." The exposure of nearly 90,000 images represents a profound failure of the digital safety net that should protect all citizens, regardless of their public status.

Broader Impact and Implications for Digital Safety

The implications of the Cocospy breach extend far beyond the immediate victims. It serves as a cautionary tale for the broader public about the dangers of the "surveillance-for-hire" economy. When data is collected without consent, it exists in a state of perpetual risk. There is no such thing as "secure" stalkerware; the very nature of the software requires the creation of a massive, centralized database of intimate information that acts as a honeypot for malicious actors.

For the cybersecurity community, this incident reinforces the need for more aggressive monitoring of open cloud repositories. Misconfigurations remain one of the leading causes of data exposure globally. When corporate entities leave buckets open, it is a business crisis; when stalkerware providers leave buckets open, it is a human rights crisis.

As the investigation into this breach continues, the focus remains on identifying how many individuals may have accessed the repository before it was secured. While Fowler acted ethically by reporting the find, there is no guarantee that other, less scrupulous actors did not discover the same data troves. For the European celebrity and the models and influencers caught in the digital dragnet, the damage may already be done, leaving a permanent stain on their digital privacy.

This event underscores the urgent necessity for mobile operating system developers, such as Google and Apple, to continue hardening their platforms against "stealth" installations and for international law enforcement to take a more proactive stance against the companies that profit from the proliferation of stalkerware. Until the industry is held to account, the private lives of thousands will continue to sit in unprotected cloud repositories, just one misconfiguration away from public exposure.