Amazon’s Ongoing Data Breach: Stalkerware Victims’ Information Still at Risk Weeks Later
Amazon’s Cloud Services are currently under scrutiny for potentially hosting surveillance applications that compromise users’ privacy. Despite being informed weeks ago about the situation, Amazon has not disclosed any plans to address the issue of phone surveillance apps storing private data on its cloud servers. These apps, known as Cocospy, Spyic, and Spyzie, are allegedly operating with stolen data, raising serious concerns about user security and data privacy.
Ongoing Surveillance Issues
Recent reports indicate that Cocospy, Spyic, and Spyzie—three nearly identical Android applications—are utilizing Amazon Web Services (AWS) to store sensitive information from over 3.1 million individuals. Many of these victims are unaware that their devices have been compromised.
Details of the Breach
- These apps share similar source code and security vulnerabilities, making them a significant threat.
- A security researcher alerted TechCrunch of the situation, which has been confirmed through data shared with Have I Been Pwned.
- TechCrunch notified Amazon about the compromised data on multiple occasions, including specific details about the storage buckets used to host the stolen data.
Amazon’s Response
In response to TechCrunch’s inquiries, Amazon spokesperson Ryan Walsh emphasized that AWS has strict terms of service that require compliance with applicable laws. He stated, “When we receive reports of potential violations of our terms, we act quickly to review and take steps to disable prohibited content.” However, as of the time of this article, the storage buckets associated with these apps remain active.
A Procedural Standstill
Despite the clear evidence provided by TechCrunch, Amazon has not taken action against the applications. Walsh noted that TechCrunch had not submitted a formal abuse report through the provided channels. This procedural issue raises questions about the effectiveness of Amazon’s policies in protecting users from malicious software.
Why This Matters
This situation illustrates the challenges of policing content hosted on large cloud platforms like AWS. As Amazon profits significantly from its cloud services—reporting a profit of $39.8 billion in 2024—it holds substantial resources to enforce its policies against abusive practices. However, it appears to be prioritizing procedural adherence over swift action to protect users’ privacy.
Investigative Efforts
In tackling the issue of spyware, TechCrunch has conducted thorough investigations into the operations of these apps. The aim is to:
- Identify victims whose data has been compromised.
- Reveal the identities of the surveillance operators.
- Analyze the applications to assist victims in detecting and removing the malicious software.
By utilizing network analysis tools, TechCrunch confirmed that the stalkerware apps were successfully uploading personal data, such as photos, to AWS storage buckets. This alarming discovery underscores the urgent need for action against such applications.
Need Help? Resources Available
If you or someone you know might be affected by these issues, the National Domestic Violence Hotline offers 24/7 confidential support to victims of abuse. For those concerned about spyware on their devices, the Coalition Against Stalkerware provides valuable resources and assistance.
Staying informed and vigilant about the apps installed on your devices is essential in today’s digital age. Awareness and action can help protect you and others from potential privacy violations.
