Stalkerware maker pcTattletale was breached, then deleted everything and died

In May 2024 pcTattletale, a US stalkerware app that let a planter remotely view screenshots of a victim's Android or Windows device from anywhere, was breached: a hacker defaced its website and published links to large amounts of data from its servers, including customer databases and some victims' stolen data. Breach-notification site Have I Been Pwned counted 138,000 customer accounts.

The hacker said the app's servers could be tricked into handing over the private keys for its Amazon Web Services account, which stored hundreds of millions of screenshots of monitored devices; TechCrunch verified more than 300 million such screenshots on an Amazon S3 server, and that screenshots from real monitored devices were publicly accessible. The app had advertised employee monitoring while also openly promoting snooping on spouses and domestic partners without consent — which is illegal.

Founder Bryan Fleming told TechCrunch the company was 'out of business and completely done': he had lost access to the AWS account, and 'I deleted everything because the data breach could have exposed my customers.' The S3 server later returned Amazon's 'AllAccessDisabled' error; neither Fleming nor Amazon would say whether AWS had shut the account down. Fleming did not explain why the data was deleted without notifying the people whose information was exposed, and stopped responding to inquiries.

The company is gone: website offline, AWS account blocked, founder locked out — and the data of its 138,000 customers published via Have I Been Pwned

A product built on covert access held its victims' most private screens in one bucket — the single most damaging thing to leak.

Servers that can be tricked into surrendering cloud keys show the same weak security the product's critics alleged.

Deleting everything without notifying exposed people traded a cleanup for the appearance of a cover-up.

Marketing spying on non-consenting partners had already put the company outside what regulators and platforms tolerate.

A surveillance business that cannot secure its own keys proves its critics right — and deleting the evidence ends the company, not the exposure.

By 28 May 2024 pcTattletale's website was offline and the company declared itself out of business, following similar ends for spyware makers LetMeSpy (2023) and PhoneSpector and Highster after a New York investigation. The FTC declined to say whether it was investigating.