More than half-a-million people who bought access to phone surveillance and social media snooping apps had their email address and partial payment card numbers published online.