Creator of @haveibeenpwned. Microsoft Regional Director. Pluralsight author. Online security, technology and “The Cloud”. Australian.
Australia
- Tweets 121,405
- Following 1,317
- Followers 249,570
- Likes 1,763
Pinned Tweet
Sometimes, life feels like a fairytale. This is now my favourite photo ever ❤️
57
25
1,889
Something super weird happening right now: just been called by several totally different media outlets in the last few minutes, all with Windows machines suddenly BSoD’ing (Blue Screen of Death). Anyone else seen this? Seems to be entering recovery mode:
1,099
3,618
27,606
11,043,082
Someone just delivered me a massive data breach. It’s all there - names, addresses, phone numbers - huge!!!
188
1,343
8,130
I’m a responsible parent so I use the controls on iOS to limit screen time on the old iPhone my 9-year old uses. A white-listed exception is iMessage; he’s worked out he can send someone a YouTube vid then watch it in iMessage to circumvent the control. So proud 😅
152
945
6,963
I’d like to say a big “thank you” to @realDonaldTrump for providing me with material that’s going to feature in many, many presentations for years to come 🤣
108
851
5,753
I love that part of the Microsoft Security Score for Identity in Azure improves your score if you *don't* enforce password rotation, what a sign of the times! Who out there still works somewhere that forces rotation (because "reasons")?
175
809
5,425
5 months to the day since @elonmusk took over Twitter. It still works just fine. There are new features. This isn’t the outcome many people were predicting.
362
217
5,135
2,490,940
Hi folks, yes, I'm aware of this. I've been in communication with the Internet Archive over the last few days re the data breach, didn't know the site was defaced until people started flagging it with me just now. More soon.
Was the Internet Archive (@internetarchive) hacked? 😬I got this JS alert while loading an archived page. cc: @troyhunt
19
405
3,822
340,434
This was a very uncomfortable breach to process for reasons that should be obvious from @josephfcox's article. Let me add some more "colour" based on what I found:
New sensitive breach: "AI girlfriend" site Muah[.]ai had 1.9M email addresses breached last month. Data included AI prompts describing desired images, many sexual in nature and many describing child exploitation. 24% were already in @haveibeenpwned. More: 404media.co/hacked-ai-girlfr…
32
548
3,171
882,342
It's time for @haveibeenpwned to grow up and go beyond what I can do as one person. This has taken a lot of thought over the course of this year; here's the factors driving it, the path forward and what it means for the future. Here's Project Svalbard: troyhunt.com/project-svalbar…
108
962
3,103
This is basically what we were all worried about with Y2K, except it's actually happened this time ☠️
48
413
3,032
248,401
I do my best with @haveibeenpwned. It takes huge amounts of time and effort and sometimes, is a thankless pursuit. I don’t reply to messages like this, but I’m sharing it to give just a little bit of a sense of the stuff I have to deal with to make it happen.
301
177
2,867
I don’t normally reply to these, but when someone is a big enough dickhead, I make an exception:
125
150
2,703
Anyone got a @BBC contact that can get this fixed? Not sure if this is your piece @daniel_thomasg:
"The hackers, who call themselves "Have I Been Pwned", made off with more than 31 million email addresses, usernames and passwords." view.email.bbc.com/?vawpToke…
144
181
2,666
203,922
Yep, you read that correctly 🤦♂️
New breach: Horse Isle had 28k unique email addresses breached in 2020 - twice. Data included IP address, name, gender, purchases and plain text password, including failed password attempts, also in plain text. 77% were already in @haveibeenpwned. More: hi1.horseisle.com/web/news.p…
88
392
2,671
777,739
Please change your DNA
Millions of DNA tests leaked after hackers breach company's 'forgotten' database rawstory.com/millions-of-dna…
71
551
2,463
388,040
I don’t think it’s too early to call it: this will be the largest IT outage in history
48
403
2,496
322,009
This will be a hugely unpopular thing, however...
The premise of attaching a nominal cost to a previously free service in order to combat abuse is exactly what I did with the @haveibeenpwned API keys 4 years ago: troyhunt.com/authentication-…
This stopped abuse dead. Not a little bit, not mostly, but 100%. The reason wasn't that there was no longer an ROI for abusers, rather it was because you had to stump up a credit card that could be traced back to you. Combine that with Stripe doing a very good job of identifying fraudulent use of cards (our dispute rate is 0.01% for the last 6 months) and it's now very unattractive to do nasty stuff with the service.
Clearly, they're not going to make any money out of a $1 annual fee (and for now, that's only new users in 2 countries anyway). I've no doubt based on my own experiences that it'll put a massive dent in abuse originating from those markets, I'm just not sure how much it will piss off their user base. Or how much it will matter.
205
242
2,496
1,406,235
One day, I'm going to do a NSFW only conference talk on the weirdest data breaches I've ever processed. The one I just got sent is going to be right up there at the top of the list. HOLY. SHIT.
68
90
2,220
444,540
Call comes in:
“Hi this is Telstra, we need to verify your identity”
“Sure, can you verify your identity first?”
“Uh, we’re Telstra”
“Ah, but that’s not how this is going to work, can you verify my account information”
“But we need to verify you first!”
Yeah, nah, bye!
93
361
2,153
People have been telling me to do this for ages so here it is - I'm open sourcing the code base for @haveibeenpwned. It's non-trivial, but it's the right thing to do. Here's the story: troyhunt.com/im-open-sourcin…
36
636
2,086
I've wanted to do this post for ages & it's finally done - "Here's Why Your Static Website Needs HTTPS". It's a 24 min video showing a bunch of nasty stuff that can happen to *any* site served insecurely from crypto miners to credential phishing to Clippy: troyhunt.com/heres-why-your-…
21
985
2,028
The issue is worldwide: dailymail.co.uk/news/article…
18
166
1,976
577,205
I’ve had a heap of queries about this. I’m looking into it and yes, if it’s legit and suitable for @haveibeenpwned it’ll be searchable there shortly.
60
663
1,906
New data breach now loading into @haveibeenpwned that'll push it *well* over 10,000,000,000 records. Wow. Insane, never thought I'd be here doing this with those numbers. It's been a fun little project 🙂
47
360
1,895
So apparently a @haveibeenpwned email wiped an entire ticketing system due to the SQL injection pattern I put in the contents of it 🤣 fyr.io/2020/05/30/haveibeenp…
53
442
1,851
It's been a huge piece of work, but it's done: here's more than half a billion passwords for you to download for free and use to help protect your systems. Or use the online k-Anonymity API developed in conjunction with @Cloudflare. It rocks! troyhunt.com/ive-just-launch…
46
1,082
1,785
Running a free service is bloody thankless at times, I've just got no patience of this sort of shit
76
59
1,732
10 years ago today, I started a pet project with a stupid name. Like all my previous projects, I expected it to scratch an itch and then fail miserably. But @haveibeenpwned didn't do that, not by a long shot. A decade later here we are! 🎂 troyhunt.com/a-decade-of-hav…
48
162
1,743
116,894
Felt really sad waking up and seeing “RIP Kevin” in my timeline. I doubt there is a more well known name in our industry but if he’s unfamiliar to you (or you haven’t read this book), go and grab “Ghost in the Wires” which is an exceptional read.
Kevin started regularly coming to the Gold Coast about 6 years ago. I first met him here just after I’d gotten a boat and thought it would be a great idea to take him and my kids on a ride to a pretty secluded island. We had an awesome trip over, moored just off the beach then sat at a little cafe having lunch. When we went to leave, the tide had dropped and the boat was sitting half way up the beach, going nowhere. And a storm was coming. We ended up spending hours sitting in the cafe into the night while we played Jenga and he taught the kids card tricks. Eventually, late and dark with the storm still raging, we headed home anyway navigating through the pitch dark via the flashing red and green beacons. We came home drenched and according to Kevin, elated anyway at an awesome day out 😊
I never stranded Kevin anywhere again, but we did do more boat trips in the years to follow. The stories this guy had were nuts; obviously the hacking, but changing identities, being on the run, getting locked up and perhaps what hit the most, solitary confinement. It was a crazy time he found himself in (“Kevin might whistle nuclear launch codes into the telephone”), and he paid a hefty price. But he also later made a hell of an honest career out of it and became highly entertaining, and highly in demand. He was polarising, but there’s no arguing he earned his way to the top.
You kinda hope that when you pass on, that’s not the end of it insofar as you’ve made a lasting difference. We’ll still be talking about Kevin for decades to come, and there’s no arguing that he helped shaped the industry to become what it is today. A colourful character and friend, RIP Kevin.
dignitymemorial.com/obituari…
35
135
1,716
197,115
I’ve had a lot of people tweeting this at me so let me give you 2 thoughts on it:
1) Making 2FA a premium service sends a bad message
2) Putting a price on the weakest form of 2FA and keeping 2 much better alternatives free is good
96
279
1,680
313,625
Another cool little @Cloudflare thing that snuck out recently is this very simple security.txt creator:
13
133
1,730
142,728
Your hacker name is your first pet’s name followed your mother’s maiden name and the town you were born in. What’s yours?
247
467
1,580
WE DIDN’T EVEN MAKE IT THROUGH ONE DAY IN 2019!!!
Victorian Government employees' details stolen in data breach abc.net.au/news/2019-01-01/v…
35
504
1,591
Me to my wife:
“Uh, what brand is our new washing machine?”
“Samsung”
“Why the fuck is it broadcasting an SSID?!”
70
356
1,492
Oh for fucks sake. I seriously did not know I had an account in this breach until this email from @haveibeenpwned just landed. Thanks @troyhunt 🤬
50
146
1,501
Don't think I've seen someone store both a password hash *and* the plain text of it in a data breach! That's, uh... "special" 🤦♂️
109
460
1,491
Every time I come back to Europe, I’m reminded of the absolute batshit insanity that cookie warnings are. Idiotic, poorly thought out, user experience-killing compliance garbage that can’t possibly do anything to improve privacy in any meaningful way whatsoever.
91
242
1,508
I took the brief tweet thread I did earlier today on the alleged @MinneapolisPD hack and ran the emails and passwords through @haveibeenpwned. It's not a new breach, it's existing data that's falsely attributed and is causing disinformation to spread troyhunt.com/analysing-the-a…
31
659
1,339
In 2013, I built the front end of @haveibeenpwned on Bootstrap and jQuery. In 2025, @stebets and I are rebuilding it as part of a rebrand. What should we use? What are the front end tools that make web dev awesome today? (vanilla HTML, CSS and JS aside, of course)
275
63
1,461
233,990
Remember when the biggest worry we had about candles was the house burning down because *you* left one on? Get ready for other people to start sparking them up for you remotely with “smart” candles... with real fire! kickstarter.com/projects/can…
105
493
1,279
6 years, 416 breaches and 9,138,980,630
pwned accounts later - it’s @haveibeenpwned’s birthday! 🎂 troyhunt.com/introducing-hav…
37
257
1,336
I’m so sick of these dickheads. Meanwhile, I’m trying to report massive data breaches to orgs who aren’t replying because they get so much crap like Sam’s!
39
35
1,401
124,686
Alleged breach of 400M+ Twitter accounts. Legitimacy isn’t yet clear, but the aggressive, threatening wording is unmistakable. Of course Twitter will never pay, so let’s see what happens next.
54
322
1,297
717,567
Just an important point on this as I’m seeing some misunderstandings: this is not a “Microsoft outage” (disclosure: I don’t work there or speak for them, Regional Directors are totally independent), it’s a CrowdStrike issue impacting Microsoft PCs.
34
184
1,298
229,940
Anyone got a security contact at ISIS?
🚨Data Breach Alert - ISIS
The threat actor known as '0BITS' has claimed responsibility for a data breach affecting ISIS (Islamic State of Iraq and Syria), allegedly exposing critical data from 2023.
According to the post, the leaked information includes the names of funders, origin details, partners, infrastructure, full names of members, operational plans, hostage details, and records of gift recipients for ISIS members' wives.
60
104
1,365
114,676
Not just everywhere, but every*one* (nearly). This is massive
22
214
1,265
691,011
So I just managed to lock out the @haveibeenpwned Twitter account by putting the service's birthday in and falling afoul of minimum age requirements. I'll get it sorted in a jiffy, just a heads up in case anyone notices something is up and wonders what happened.
86
133
1,195
Your DNA has been breached. Please change your DNA. bloomberg.com/news/articles/…
39
663
1,182
I'm so sick of those bullshit "your article is really nice, I think your readers would find my article useful, please link to it" spam emails that I've decided to start featuring them all. Well, kinda, here's what I'm going to do: troyhunt.com/no-i-wont-link-…
72
129
1,174
I will never stop loving this vendor response to a security flaw: "the lock is invincible to people who do not have a screwdriver" 🤣
The company that sent me the pictured fingerprint lock has provided the security quote of the year: “...the lock is invincible to the people who do not have a screwdriver.”
37
351
1,206
If you're watching this unfold and aren't unfamiliar with the name "CrowdStrike", they're a *massive* player in the security space and have billions of dollars of annual revenue. Their products include "EDR", which is endpoint detection and response. Think of it as antivirus.
12
150
1,227
196,289
Good one @Visa, absolutely no warning about truncating generated passwords from @1Password. The account gets created but then I can't login until I view the DOM and chop the end off my >32 char password. This doesn't need to be this hard...
56
165
1,206
It finally happened - I got phished. Impact is limited to the Mailchimp mailing list for my blog, brief blog post with details here and more to come later: troyhunt.com/a-sneaky-phish-…
96
218
1,257
126,230
I’m astounded to see people still arguing “my site doesn’t need HTTPS” so I’ll put it simply: either spend a few mins putting it on your site now or continually explaining to your visitors why your site is not “not secure” until you end up doing it anyway. It’s not a negotiation.
55
389
1,145
I’m very happy to announce that @haveibeenpwned’s Pwned Passwords is now open source under the @dotnetfdn. Now we’ve got some work to do: building an ingestion pipeline for new passwords provided by the @FBI on an ongoing basis. This is super cool 😎 troyhunt.com/pwned-passwords…
18
294
1,162
So here it is - my latest @pluralsight course - and why every web developer needs to understand HTTPS troyhunt.com/new-pluralsight…
100
1,094
1,134
Here it is:
- Toy captured kids voices
- Data exposed via MongoDB
- 2.2m recordings
- DB ransom'd
- And much more...
troyhunt.com/data-from-conne…
56
1,663
1,125
And in the latest edition of “why you should HTTPS all the things”, I present to you Starbucks mining BTC in your customers’ browsers
Hi @Starbucks @StarbucksAr did you know that your in-store wifi provider in Buenos Aires forces a 10 second delay when you first connect to the wifi so it can mine bitcoin using a customer's laptop? Feels a little off-brand.. cc @GMFlickinger
23
812
1,098
It had to happen eventually - I made a mistake in "the cloud" that just cost me over $11k. Ouch! Here's what happened, and what I've done to make sure it never happens again: troyhunt.com/how-i-got-pwned…
51
245
1,130
Ad targeters are pulling data from your browser’s password manager flip.it/q9kb-G
43
1,019
1,044
I’ve had a few people flag this with me as a “data breach”. It’s not, it’s authorised access. Not liking that authorisation does not make it a data breach. If one of these guys then accidentally leaks it all over the place to unauthorised parties, *then* it’s a data breach!
“This is the...largest IT security breach in our country’s history.... You can’t un-ring this bell. Once these DOGE guys have access to these data systems, they can ostensibly do with it what they want.” theatlantic.com/technology/a…
65
83
1,176
238,155
Seeing a lot of failed login attempts to my Microsoft account in the last 24 hours from all over the world. Same with my son, always about 2 hours apart, anyone else?
262
48
1,135
185,941
