Troy Hunt

Occasionally, someone takes issue with me flagging a data breach as "sensitive" such that the email addresses can't be publicly searched because they want to dox the users. That's a *really* bad idea, for many reasons:

Troy Hunt

Who Decides Who Doesn’t Deserve Privacy?

Remember the Ashley Madison data breach? That was now more than a decade ago, yet it arguably remains the single most noteworthy data breach of all...

I've had this dumb report too many times, and Bruce has finally tipped me over the edge. @npub1rqsm...83hv is a real service that looks up email addresses in actual data breaches, but some people don't understand what an email address actually is

Troy Hunt

Why Does Have I Been Pwned Contain "Fake" Email Addresses?

Normally, when someone sends feedback like this, I ignore it, but it happens often enough that it deserves an explainer, because the answer is real...

Happy birthday @npub1rqsm...83hv! 12 years ago today, I pushed out a blog post launching a little data breach search tool, and life changed forever. Reading the post again now, did I get it right? 😎

Troy Hunt

Introducing “Have I been pwned?” – aggregating accounts across website breaches

I often write up analyses of the passwords disclosed in website breaches. For example, there was A brief Sony password analysis [https://www.troyhu...

This has been an extraordinary set of data to process: 1.3B unique passwords, 2B unique email addresses (including mine 😭) and almost 3M of our @npub1rqsm...83hv subscribers in there. It’s been weeks of processing to get this loaded, and finally, it’s done

Troy Hunt

2 Billion Email Addresses Were Exposed, and We Indexed Them All in Have I Been Pwned

I hate hyperbolic news headlines about data breaches, but for the "2 Billion Email Addresses" headline to be hyperbolic, it'd need to be exaggerate...

Can you believe it’s ten years to the day since the Ashley Madison data breach hit the news?! It’s still arguably the most impactful, most widely publicised data breach in history.

Online Cheating Site AshleyMadison Hacked – Krebs on Security

After a gargantuan effort, the all-new @npub1rqsm...83hv brand and website is now officially live!

Troy Hunt

Have I Been Pwned 2.0 is Now Live!

This has been a very long time coming, but finally, after a marathon effort, the brand new Have I Been Pwned website is now live! Feb last year...

I'm looking for some contacts at companies that provide identity protection services, any followers out there? Further, have you had good experiences with any specific companies? There are some product placement opportunities we're exploring in the updated @npub1rqsm...83hv site.

I'm writing up a blog post called "Passkeys for Normal People", which is a non-trivial exercise. For example, whilst LinkedIn "supports" passkeys, it doesn't seem to allow using them as a second factor *or* a sole factor, so you're still left with passwords and OTPs. Correct?

It finally happened - I got phished. Impact is limited to the Mailchimp mailing list for my blog, brief blog post with details here and more to come later:

Troy Hunt

A Sneaky Phish Just Grabbed my Mailchimp Mailing List

You know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, an...

I'm speaking at the University of Oxford next week (yes, the UK one), as part of their Programme for Cyber and Technology Policy. It's a free event, come along if you're over that way: https://www.bsg.ox.ac.uk/events/lessons-billions-data-breaches