Troy Hunt

It finally happened - I got phished. Impact is limited to the Mailchimp mailing list for my blog, brief blog post with details here and more to come later: www.troyhunt.com/a-sneaky-phi...

A Sneaky Phish Just Grabbed my Mailchimp Mailing List

You know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish h...

This is such cool analysis of PIN in @haveibeenpwned.com's Pwned Passwords. Scroll through the page and watch the heat map change alongside the explanations of how people are creating (somewhat) predictable PINs: www.abc.net.au/news/2025-01...

Is your PIN code among the first ones hackers are likely to try?

The ABC analysed 29 million stolen codes to help you avoid using an insecure one.

Great outcome by our global law enforcement partners, that's some big numbers: "at least 40,000 phishing domains linked to LabHost, which had some 10,000 users worldwide". Let's make those phished passwords useless, they're now all in @haveibeenpwned.com: www.europol.europa.eu/media-press/...

International investigation disrupts phishing-as-a-service platform LabHost | Europol

International investigation disrupts phishing-as-a-service platform LabHost

A few years ago, I wrote a book. It was the culmination of my most important posts and the stories behind them. Writing this book also helped keep me sane during insane times, and as of today, I'm giving it away for free 😊 www.troyhunt.com/pwned-the-bo...

"Pwned", The Book, Is Now Available for Free

Nearly four years ago now, I set out to write a book with Charlotte and RobIt was the stories behind the stories, the things that drove me to write my most important blog posts, and then the things th...

This is big - data breach at Discord (or at least at an unnamed third-party): discord.com/press-releas...

Update on a Security Incident Involving Third-Party Customer Service | Discord

At Discord, protecting the privacy and security of our users is a top priority. That’s why it’s important to us that we’re transparent with them about events that impact their personal information.

Happy birthday @haveibeenpwned.com! 12 years ago today, I pushed out a blog post launching a little data breach search tool, and life changed forever. Reading the post again now, did I get it right? 😎 www.troyhunt.com/introducing-...

Introducing “Have I been pwned?” – aggregating accounts across website breaches

I often write up analyses of the passwords disclosed in website breaches. For example, there was A brief Sony password analysis [https://www.troyhunt.com/2011/06/brief-sony-password-analysis.html] bac...

I recently had a great meetup with @ncsc.gov.uk largely discussing the importance of passkeys. "I should write up a blog post for normal people", I suggested, then went back to my hotel and got phished 🤦‍♂️ Finally, here's that blog post: www.troyhunt.com/passkeys-for...

Passkeys for Normal People

Let me start by very simply explaining the problem we're trying to solve with passkeys. Imagine you're logging on to a website like this: And, because you want to protect your account from being logg...

After a gargantuan effort, the all-new @haveibeenpwned.com brand and website is now officially live! www.troyhunt.com/have-i-been-...

Have I Been Pwned 2.0 is Now Live!

This has been a very long time coming, but finally, after a marathon effort, the brand new Have I Been Pwned website is now live! Feb last year is when I made the first commit to the public repo f...

Well this just made life a lot easier - ChatGPT hash cracking!

Finally, after 11 years and 97 days, @haveibeenpwned.com has a new look! Today, we're "soft launching" the rebrand, that is we're giving everyone a look and welcoming contributions, but you won't see it on any publicly facing assets yet. What do you think? www.troyhunt.com/soft-launchi...

Soft-Launching and Open Sourcing the Have I Been Pwned Rebrand

Designing the first logo for Have I Been Pwned was easy: I took a SQL injection pattern, wrote "have i been pwned?" after it and then, just to give it a touch of class, put a rectangle with rounded co...

This has been an extraordinary set of data to process: 1.3B unique passwords, 2B unique email addresses (including mine 😭) and almost 3M of our @haveibeenpwned.com subscribers in there. It’s been weeks of processing to get this loaded, and finally, it’s done www.troyhunt.com/2-billion-em...

2 Billion Email Addresses Were Exposed, and We Indexed Them All in Have I Been Pwned

I hate hyperbolic news headlines about data breaches, but for the "2 Billion Email Addresses" headline to be hyperbolic, it'd need to be exaggerated or overstated - and it isn't. It's rounded up from ...

Occasionally, someone takes issue with me flagging a data breach as "sensitive" such that the email addresses can't be publicly searched because they want to dox the users. That's a *really* bad idea, for many reasons: www.troyhunt.com/who-decides-...

Who Decides Who Doesn’t Deserve Privacy?

Remember the Ashley Madison data breach? That was now more than a decade ago, yet it arguably remains the single most noteworthy data breach of all time. There are many reasons for this accolade, but…

That's a massive milestone - 1,000 breaches processed in @haveibeenpwned.com - and it got me wondering why the service is still needed? But you don't have to look far to see why: www.troyhunt.com/1000-data-br...

1,000 Data Breaches Later, the Disclosure Lag is Worse Than Ever

Today, I loaded the 1,000th data breach into Have I Been Pwned. Reflecting on that milestone number, I pondered how to mark the occasion in writing, and what immediately came to mind was a very simple...

As the clock counts down to the deadline the Qantas hackers have threatened to publish their data on, how much will the court injunction actually help the breach victims (which includes me)? www.troyhunt.com/court-injunc...

Court Injunctions are the Thoughts and Prayers of Data Breach Response

You see it all the time after a tragedy occurs somewhere, and people flock to offer their sympathies via the "thoughts and prayers" line. Sympathy is great, and we should all express that sentiment…

10 years ago today, I started a pet project with a stupid name. Like all my previous projects, I expected it to scratch an itch and then fail miserably. But Have I Been Pwned didn't do that, not by a long shot. A decade later here we are! 🎂 www.troyhunt.com/a-decade-of-...

We're very happy to help the amazing people at @cern.bsky.social gain greater insights into the impact of data breaches on the work they do. CERN is the first intergovernmental organisation we've onboarded to @haveibeenpwned.com, here's the background: www.troyhunt.com/welcoming-ce...

Welcoming CERN to Have I Been Pwned

It's hard to explain the significance of CERN. It's the birthplace of the World Wide Web and the home of the largest machine ever built, the Large Hadron Collider. The bit that's hard to explain is, w...

I'm coming to Switzerland! Join me at the Microsoft Azure Zürich User Group in only a few weeks from now: www.meetup.com/de-DE/micros...

[In Person] Troy Hunt Have I Been Pwned Alpine Grand Tour Zürich , Di., 17. Juni 2025, 18:00 | Meetup

**IN-PERSON** Troy Hunt meetup at **Kraftwerk in Zurich** This meetup is a collaboration between several Swiss User Groups: [Azure Zurich User Group ](https://www.azurezur

Can you believe it’s ten years to the day since the Ashley Madison data breach hit the news?! It’s still arguably the most impactful, most widely publicised data breach in history. krebsonsecurity.com/2015/07/onli...

Online Cheating Site AshleyMadison Hacked

Large caches of data stolen from online cheating site AshleyMadison.com have been posted online by an individual or group that claims to have completely compromised the company's user databases,…

It sucked getting phished, but I couldn’t be happier with the community responses and positive outcomes from sharing this experience 😊

Neil C Ford @neilcford.uk

Having read @troyhunt.com's article on being phished www.troyhunt.com/a-sneaky-phi... I have today gone through my @1password.bsky.social vault adding 2FA and Passkeys where I can. Also cleaned out quite a few redundant credentials. #security #daywellspent 👍

A Sneaky Phish Just Grabbed my Mailchimp Mailing List

You know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish h...

We're going full steam ahead on the @haveibeenpwned UX rebuild! Loads of static interfaces are now ready for review in the open source repo here: github.com/haveIBeenPwn...

GitHub - HaveIBeenPwned/ux-rebuild: A repository to collaborate on the UX rebuild of Have I Been Pwned

A repository to collaborate on the UX rebuild of Have I Been Pwned - HaveIBeenPwned/ux-rebuild

Yesterday, someone tried to sell an alleged data breach of JB Hi-Fi. The breach was a hoax, and it was dead simple to prove 😊 www.troyhunt.com/you-cant-tru...

You Can't Trust Hackers, and Other Data Breach Verification Tales

It's hard to find a good criminal these days. I mean a really trustworthy one you can be confident won't lead you up the garden path with false promises of data breaches. Like this guy yesterday: For...

I've had this dumb report too many times, and Bruce has finally tipped me over the edge. @haveibeenpwned.com is a real service that looks up email addresses in actual data breaches, but some people don't understand what an email address actually is www.troyhunt.com/why-does-hav...

Why Does Have I Been Pwned Contain "Fake" Email Addresses?

Normally, when someone sends feedback like this, I ignore it, but it happens often enough that it deserves an explainer, because the answer is really, really simple. So simple, in fact, that it should...

It’s not a real data breach unless it causes people serious harm. Words to that effect are rife throughout privacy reforms that continue to prioritise the responsible organisation over the impacted individuals www.ashurst.com/en/insights/...

I'm looking for some contacts at companies that provide identity protection services, any followers out there? Further, have you had good experiences with any specific companies? There are some product placement opportunities we're exploring in the updated @haveibeenpwned.com site.