Troy Hunt

Creator of @haveibeenpwned. Microsoft Regional Director. Pluralsight author. Online security, technology and “The Cloud”. Australian.

[Troy Hunt @troyhunt]

Sometimes, life feels like a fairytale. This is now my favourite photo ever ❤️

[Have I Been Pwned @haveibeenpwned]

New breach: Baker Distributing had 103k unique email addresses allegedly exposed after appearing on the ShinyHunters "pay or leak" site. The data was mostly corporate contact info including names, addresses and phones. 50% were already in @haveibeenpwned: https://t.co/PmfWpHKRie

[Troy Hunt @troyhunt]

Going live with my weekly vid in 10 mins! Have I Been Pwned Passes 1,000 Data Breaches: Join Me for a Commemorative Beer 🍺 https://t.co/QIKdd0e5st

[Troy Hunt @troyhunt]

I’ve had so many discussions with breached organisations considering if they should disclose. This is the scenario I always paint: one day, the truth may come out, and you’ll forever be waiting for that day when you’re going to have a *really* serious problem.

[TechCrunch @TechCrunch]

Former cyber executive turned whistleblower accuses IBM of covering up several data breaches https://t.co/M33Qnr8fpG

[Have I Been Pwned @haveibeenpwned]

New breach: BCD Travel was targeted in a ShinyHunters extortion campaign that published 396k email addresses this week. Other data included name, address, phone, job title and support tickets. 28% were already in @haveibeenpwned. Read more: https://t.co/tY9awopINM

[Troy Hunt @troyhunt]

This has gotta be the laziest @Mailchimp phish ever: “uh, can you just export your entire mailing list and send it to us?” 🤣

[Have I Been Pwned @haveibeenpwned]

New breach: DentaQuest was targeted by a ShinyHunters extortion campaign that saw 2.6M unique email addresses published last weekend. Data also included name, phone, address and for some records, Medicaid ID. 66% were already in @haveibeenpwned. More: https://t.co/AG1wWFCIYj

[Troy Hunt @troyhunt]

The free gov program at @haveibeenpwned keeps expanding! Today, we welcome our 46th government: the Philippines 🇵🇭

Their National CERT is now using HIBP to help protect government departments, public resources and the people behind them. https://t.co/ezsXdYDnWS

[Troy Hunt @troyhunt]

Weekly update is up! Breach Week: 7-Eleven; Ameriprise; Mytheresa; Kemper; Charter; The Data Breach Disclosure Lag; Welcoming the Bhutanese Government https://t.co/15ZtVut7ex

[Troy Hunt @troyhunt]

@keenthinker @haveibeenpwned Because anyone has been on the internet for a while easily has 100+ accounts. Get 1% of those breached each year and the numbers stack up real fast.

[Troy Hunt @troyhunt]

That's a massive milestone - 1,000 breaches processed in @haveibeenpwned - and it got me wondering why the service is still needed? But you don't have to look far to see why: https://t.co/4NBrmga6u9

[Troy Hunt @troyhunt]

@maxsec @c4i @haveibeenpwned Yeah, more a milestone than a celebration I think

[Troy Hunt @troyhunt]

1,000 data breaches later 😮

[Have I Been Pwned @haveibeenpwned]

New breach: Edmunds was listed by ShinyHunters as allegedly breached in Jan, with the data later published online. It contained 178k unique email addresses, usernames, IP addresses, phone numbers and passwords. 91% were already in @haveibeenpwned. More: https://t.co/zoS1LXeN1G

[Have I Been Pwned @haveibeenpwned]

New breach: Edmunds was listed by ShinyHunters as allegedly breached in Jan, with the data later published online. It contained 178k unique email addresses, usernames, IP addresses, phone numbers and passwords. 91% were already in @haveibeenpwned. More: https://t.co/zoS1LXeN1G

[Have I Been Pwned @haveibeenpwned]

New breach: The Atlas Menu GTA V and CS2 cheat service had 64k accounts breached yesterday. Data includes email and IP addresses, usernames, passwords stored as bcrypt hashes and support tickets. 49% were already in @haveibeenpwned. Read more: https://t.co/rBW20cB1EH

[Troy Hunt @troyhunt]

Going live with my weekly vid in 15 mins! Breach Week: 7-Eleven; Ameriprise; Mytheresa; Kemper; Charter; The Data Breach Disclosure Lag; Welcoming the Bhutanese Government https://t.co/BLRGqdfXHo

[Troy Hunt @troyhunt]

@fortinho Yep, that’s a fair assessment

[Troy Hunt @troyhunt]

Aw, I got the SendGrid Pride phish! Four times, to,different (fairly public) addresses.

[Troy Hunt @troyhunt]

@thetomaspatera LOL, you can just picture the demographic they’re targeting 🤣

[Have I Been Pwned @haveibeenpwned]

New breach: Charter Communications was named in a ShinyHunters "pay or leak" extortion campaign last week after which 4.9M unique email addresses along with name, phone number and physical address were published. 68% were already in @haveibeenpwned. More: https://t.co/gS1ouS5doI

[Troy Hunt @troyhunt]

That’s 5 weeks where most people in there had no idea their personal info had been obtained by criminals then broadly distributed to other criminals! Privacy regs aren’t fixing this and anecdotally, the disclosure lag is worse than ever, especially with these extortion incidents.

[Troy Hunt @troyhunt]

35 days ago, the Carnival data was published by ShinyHunters. Clearly, the company knew about it at the time (that’s how extortion works, plus the comment in the linked article) but at the time, I couldn’t find any disclosure notice, just the comment to press.

[Have I Been Pwned @haveibeenpwned]

New breach: Cruise operator Carnival was targeted in a ShinyHunters “pay or leak” attack last week. 8.7M records with 7.5M email addresses and loyalty program data were published yesterday. 85% were already in @haveibeenpwned. Read more: https://t.co/QhqNt0WucV

[Troy Hunt @troyhunt]

Now, 35 days after the data went *very* public, there’s finally formal disclosure https://t.co/45xCAdF7Pa