Troy Hunt

Troy Hunt

@troyhunt.com

Founder & CEO of @haveibeenpwned.com, the most trusted name in data breach intelligence. Speaker, blogger, Microsoft Regional Director. Gold Coast, Australia.

16.5K followers45 following565 posts

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New sensitive breach: German political party AfD suffered a breach last month that resulted in hundreds of thousands of emails and attachments being published, exposing 345k unique email addresses. 47% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/AfD

haveibeenpwned.comHave I Been Pwned: AfD Data BreachIn September 2026, the German political party Alternative für Deutschland (AfD) suffered a data breach which exposed 345k unique email addresses. The following month, hundreds of gigabytes of data con...
Troy Hunt
@troyhunt.com

Never ever changing this project name, it's too much fun 🤣

Peter Hicks@poggs.com

A speech-to-text failure - the BBC's system doesn't seem to know what pwned is :D / cc: @troyhunt.com

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: Assurance Retraite suffered a breach in 2024 exposing 370k assistance beneficiaries with 70k unique email addresses. Data also included name, address, phone and French social security numbers (NIR). 59% were already in @haveibeenpwned.com. More: haveibeenpwned.com/Breach/Assur...

haveibeenpwned.comHave I Been Pwned: Assurance Retraite Data BreachIn September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along ...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: Gîtes de France suffered a breach in May which exposed 118k unique email addresses alongside names, phone numbers, physical addresses and booking details. 76% of addresses were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Gites...

haveibeenpwned.comHave I Been Pwned: Gîtes de France Data BreachIn May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, inclu...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: In January, ShinyHunters targeted Crunchbase in a "pay or leak" extortion campaign. Published data included 560k email addresses, names, phone numbers, physical addresses, job titles and employers. 53% were already in @haveibeenpwned.com. More: haveibeenpwned.com/Breach/Crunc...

haveibeenpwned.comHave I Been Pwned: Crunchbase Data BreachIn January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt. Data allegedly obtained from the company was subsequently publishe...
Troy Hunt
@troyhunt.com

Weekly update is up! AI Data Breach Hyperbole: For all the attention on AI-powered hacking, we keep seeing companies lose millions of customer records because someone picked up the phone, impersonated IT support and talked their way in www.troyhunt.com/weekly-updat...

troyhunt.comWeekly Update 525: AI Data Breach HyperboleI remember the name of that AI doco now - The AI Doc: Or How I Became an Apocaloptimist. I was watching it on the long-haul flight home the other day, and what I found particularly engrossing was the…

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: An August ShinyHunters extortion campaign against Sharecare allegedly exposed 318k email addresses, mostly business contacts, plus some Brazilian health plan member data. 73% were already in @haveibeenpwned.com. More: haveibeenpwned.com/Breach/Share...

haveibeenpwned.comHave I Been Pwned: Sharecare Data BreachIn August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's syst...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: Neogen was targeted by ShinyHunters in August. Data allegedly stolen from the company was later published, including 436k unique email addresses, names and other mostly corporate contact details. 59% were already in @haveibeenpwned.com. More: haveibeenpwned.com/Breach/Neogen

haveibeenpwned.comHave I Been Pwned: Neogen Data BreachIn August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters "pay or leak" extortion attempt. The group later published data it claimed had been obtained from Neogen...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: CyrusOne faced a ShinyHunters extortion attempt in August. Alleged breach data was later published: 373k unique email addresses, names and largely corporate contact info for users and leads. 84% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Cyrus...

haveibeenpwned.comHave I Been Pwned: CyrusOne Data BreachIn August 2026, data centre operator CyrusOne was the target of a ShinyHunters "pay or leak" extortion attempt. The group subsequently published data allegedly obtained from the company, which include...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: Discord server protection service Double Counter suffered a breach earlier this week due to a Metabase vulnerability. The data included 275k unique email addresses and Discord usernames. 25% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Doubl...

haveibeenpwned.comHave I Been Pwned: Double Counter Data BreachIn October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter advi...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: Angel One had 7.9M customer records breached in 2023, including 6.8M unique email addresses. Data included name, physical address, phone number, bank account number, PAN and portfolio holdings. 53% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Angel...

haveibeenpwned.comHave I Been Pwned: Angel One Data BreachIn July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023. The leaked data included 7.9M user records containing 6.8M un...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New sensitive breach: Swiss medical device company Medela was targeted in a ShinyHunters extortion attack this month. Allegedly breached data was later published, including 424k unique email addresses. 62% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Medela

haveibeenpwned.comHave I Been Pwned: Medela Data BreachIn September 2026, Swiss medical device company Medela was the target of a ShinyHunters "pay or leak" extortion campaign. The data allegedly obtained in the breach was later published publicly and inc...
Troy Hunt
@troyhunt.com

Weekly update is up! We're live from Oslo with @scotthelme.bsky.social talking about the UniFi Travel Router, email signatures, malicious browser extensions and recent conference talks: www.troyhunt.com/weekly-updat...

troyhunt.comWeekly Update 522: Live From Oslo with Scott HelmeHeads up: the first 7 mins is a bit quiet until we worked out the external mic was misbehaving - sorry! But get through that and have a listen to Scott's experiences with how Report URI is identifying...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: The LimeLeads B2B marketing platform (now defunct) had 17.8M unique email addresses exposed in 2019. Largely corporate contact data also included phone number, job title, employer and location. 50% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/LimeL...

haveibeenpwned.comHave I Been Pwned: LimeLeads Data BreachIn 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of la...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: Burger King Russia had 3.2M unique email addresses exposed via the Mindbox marketing automation platform in 2024. Data also included names, phone numbers, genders, DoBs and geolocations. 60% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Burge...

haveibeenpwned.comHave I Been Pwned: Burger King Russia Data BreachIn October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email address...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New scrape: Last month, 4.6M email addresses from Chess[.]com were posted online with names, usernames and country, among other data. 99% were already in @haveibeenpwned.com, supporting the theory the data was scraped. Read more: haveibeenpwned.com/Breach/Chess...

haveibeenpwned.comHave I Been Pwned: Chess.com (2026) Data BreachIn August 2026, millions of records allegedly sourced from Chess.com were posted online. The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data ...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New sensitive breach: McKesson was targeted in a ShinyHunters extortion campaign last month. Allegedly sourced data was later published with 6.4M emails from marketing campaigns, patients, staff and others. 66% were already in @haveibeenpwned.com. More: haveibeenpwned.com/Breach/McKes...

haveibeenpwned.comHave I Been Pwned: McKesson Data BreachIn August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published a substantial corpus of data they alleg...
Troy Hunt
@troyhunt.com

Four years of exposure 😮

Scott Helme@scotthelme.bsky.social

They exposed data on 8.8 million people with no exploit, no malware, and no access to MAG’s servers. Three server-side API keys sat in public JavaScript for 4+ years and FulcrumSec found them. They could have modified and deleted data too. scotthelme.co.uk/no-hacking-r...

scotthelme.co.ukNo Hacking Required: The Manchester Airports Group Data BreachOn 27 August 2026, Manchester Airports Group told customers that "an unauthorised third party" had stolen their data. Car park bookings, lounge bookings, Fast Track purchases for airport security and…

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: Manchester Airports Group was breached last month, with FulcrumSec later publishing 8.7M email addresses. Data included phone numbers, vehicle registrations, parking history and airport purchases. 62% were already in @haveibeenpwned. More: haveibeenpwned.com/Breach/Manch...

haveibeenpwned.comHave I Been Pwned: Manchester Airports Group Data BreachIn August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services. The incident was later claimed by the FulcrumSec hacking group, who subsequently published email addre...
Troy Hunt
@troyhunt.com

Just blogged: It's very easy to pull email addresses from a data breach and make claims about scope that are completely wrong. Like - MASSIVELY wrong - for example: www.troyhunt.com/a-cautionary...

troyhunt.comA Cautionary Tale About Data Breach Claims, Verification and CarharttYou're not going to believe this, but turns out you can't always take criminals at their word. Actually, I'll walk that back a bit as it may not even be the cybercrime guys who got this wrong, but it…

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: Carhartt was the target of a ShinyHunters extortion campaign earlier this month. Data allegedly obtained from the company was later published, including 12.9M unique email addresses. 83% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Carha...

haveibeenpwned.comHave I Been Pwned: Carhartt Data BreachIn August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly obtained from the company including 12.9M ...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New sensitive breach: German news service NIUS had 6k unique email addresses exposed in a breach last year. Data also included names, physical addresses, purchases and partial payment details. 51% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/NIUS

haveibeenpwned.comHave I Been Pwned: NIUS Data BreachIn July 2025, the German news service NIUS suffered a data breach which was subsequently leaked publicly. The data included 6k unique email addresses along with names, physical addresses and payment d...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: Golf Canada had 569k unique email addresses allegedly obtained from its service around the middle of this year. Data also included name, DoB, gender and appx geographic location. 76% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/GolfC...

haveibeenpwned.comHave I Been Pwned: Golf Canada Data BreachIn mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates o...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: Oz Hair and Beauty was targeted in an xpl0itrs extortion attack this week. Data allegedly obtained in the attack was subsequently leaked, including 2M email addresses and other personal data. 73% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/OzHai...

haveibeenpwned.comHave I Been Pwned: Oz Hair and Beauty Data BreachIn August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack. The group subsequently published data allegedly obtained from the company, which included ...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: Fanlore suffered a breach earlier this month exposing 145k unique email addresses. Data also included usernames and passwords stored as either MD5 or PBKDF2 hashes. 23% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Fanlore

haveibeenpwned.comHave I Been Pwned: Fanlore Data BreachIn August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach resulted in the exposure of 145k unique email addresses along...

Troy Hunt reposted

Have I Been Pwned
@haveibeenpwned.com

New breach: RingCentral was targeted in a ShinyHunters extortion attack last month. The group subsequently published 1.6M email addresses and other personal info allegedly from the company. 44% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/RingC...

haveibeenpwned.comHave I Been Pwned: RingCentral Data BreachIn July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they claimed was obt...