The spyware operation’s exposed customer email addresses and passwords were shared with data breach notification service Have I Been Pwned.