Court Documents: 128 Million users were affected by a 2015 Malware app called XcodeGhost

A total of 128 million iOS users downloaded apps that were affected by the XcodeGhost malware in 2015, according to emails revealed during the Epic Games v. Apple trial.

The XcodeGhost malware was parsed into otherwise legitimate applications to mine user data in a coordinated campaign in 2015. Although the malware was quickly stopped, details about the full impact of the attack remained murky.

However, emails published as part of the Epic v. Apple trial have finally given us a clearer picture at the scope of the hack. In total, 128 million users downloaded the more than 2,500 tainted applications. About 18 million of those users were in the U.S., according to Vice, which first spottedthe emails.

In addition to revealing the magnitude of the hack, the emails also detail how Apple scrambled to work out how serious it was and notify victims.

“Due to the large number of customers potentially affected, do we want to send an email to all of them?” said Matt Fischer, vice president of the App Store. “Note that this will pose some challenges in terms of language localizations of the email, since the downloads of these apps took place in a wide variety of App Store storefronts around the world.”

Dale Bagwell, Apple’s iTunes customer experience manager at the time, agreed that a mass notification would be challenging.