Troy Hunt has collected a trove of 4.8 billion stolen identity records pulled from the darkest corners of the internet \u2014 but he isn\u2019t a hacker.<\/p>\n\n\n\n
Instead, he uses that repository to help ordinary people navigate the growing scourge of the corporate data breach. All that personal information was originally taken from brand-name services such as LinkedIn, Kickstarter, Dropbox, MySpace and the cheating website Ashley Madison, and later assembled by Hunt.<\/p>\n\n\n\n
Working barefoot and in beachwear from his home office on Australia\u2019s Gold Coast, the amiable security researcher set up his irreverent website, \u201cHave I Been Pwned?\u201d (POHND), in 2013. Millions of people have since used the free service to see if hackers have liberated their personal details from unwary companies and posted them online.<\/p>\n\n\n\n
Along the way, Hunt has become a close student of data breaches and the slipshod security that makes many companies easy prey for attackers. He\u2019s exposed several such thefts himself, in some cases identifying them before the companies themselves did.<\/p>\n\n\n\n
AN EPIDEMIC OF PWNAGE<\/b><\/p>\n\n\n\n
\u201cPwned\u201d \u2014 a deliberate misspelling of \u201cowned\u201d \u2014 is slang used by gamers to mean \u201cutterly defeated.\u201d It\u2019s an apt description of what it\u2019s like to have criminals use your Social Security number, birthdate and other personal details to commit fraud in your name.<\/p>\n\n\n\n
Hunt was invited to appear before Congress in late November to help lawmakers wrestle with this growing crisis of consumer data theft. In just the past two years, attackers have stolen sensitive information about hundreds of millions of people from the credit bureau Equifax, popular online services such as Uber and too many other companies to count.<\/p>\n\n\n\n
Much of that stolen data flows directly into the black market. \u201cData breaches are another commodity, like heroin,\u201d Hunt testified Thursday before the House Energy and Commerce Committee.<\/p>\n\n\n\n
UNLIKELY MESSENGER<\/b><\/p>\n\n\n\n
Hunt\u2019s unlikely path from Queensland\u2019s Surfers Paradise Beach to what he describes as \u201cfancy government things\u201d on Capitol Hill has been a running joke since his invitation to testify was announced. Virginia Republican Rep. Morgan Griffith, introducing Hunt to lawmakers, noted that he \u201cput on a suit and tie for us when he normally wears jeans and a black T-shirt.\u201d<\/p>\n\n\n\n
Hunt said he splurged on the brand-new Hugo Boss suit and Australian outback-style boots because he didn\u2019t have anything else to wear. He also downloaded an app that instructed him on how to tie his necktie.<\/p>\n\n\n\n
\u201cDoing my best \u2018no really, I\u2019m a professional\u2019 impersonation,\u201d he tweeted from the U.S. Capitol steps shortly before the hearing. \u201cDid it work?\u201d<\/p>\n\n\n\n
ONCE MORE UNTO THE BREACH<\/b><\/p>\n\n\n\n
Of course, this \u201cnew normal\u201d of massive data breaches is no joke. So much personal data has been publicly exposed through both theft and voluntary sharing on social media that it\u2019s eroded traditional methods for verifying identity, such as usernames, passwords or knowledge-based questions about birthdays or family history.<\/p>\n\n\n\n
In late November, Hunt helped discover a 2014 breach of the photo-sharing website Imgur after analyzing data from the hack passed along by one of his sources. Unlike Uber, which hid a recently-disclosed breach of more than 57 million stolen passenger and driver records for a year, Imgur took just 25 hours to go public after Hunt emailed the San Francisco company on Thanksgiving Day.<\/p>\n\n\n\n
\u201cTroy Hunt was extremely helpful in bringing the data breach to our attention and ensuring the sensitive data was passed to us in a secure manner,\u201d Roy Sehgal, Imgur\u2019s chief operating officer, said in an email.<\/p>\n\n\n\n
PWN ALL THE THINGS<\/b><\/p>\n\n\n\n
Hunt originally launched his site \u201cas a bit of a curiosity,\u201d he said. At the time, he was a software architect at pharmaceutical giant Pfizer; a few years later, he quit to work as an independent information security consultant and instructor.<\/p>\n\n\n\n
The researcher was analyzing data breaches floating around the web and noticed that many people were turning up in multiple data breaches. \u201cIt struck me that this was something they probably didn\u2019t know,\u201d Hunt said in a phone interview.<\/p>\n\n\n\n
People using his site can search on their email address to see whether and where their records have been exposed. Roughly 1.7 million people also subscribe to alerts that sound when their details pop up in newly discovered breaches. The website\u2019s user base has grown rapidly as bigger data breaches \u2014 some many years old \u2014 get attention.<\/p>\n\n\n\n
WEARING THE WHITE HAT<\/b><\/p>\n\n\n\n
Hunt \u201chas credibility and integrity,\u201d said U.K.-based security researcher Ian Thornton-Trump, who has used Hunt\u2019s site to build a system that keeps customer credentials safe from attacks that re-use previously disclosed passwords. \u201cHe\u2019s resisted urges, and probably significant financial value, to sell out.\u201d<\/p>\n\n\n\n
Thornton-Trump and other supporters say Hunt\u2019s usefulness has grown as more people confidentially share publicly exposed data with him, drawn by his reputation as an ethical gatekeeper of sensitive information.<\/p>\n\n\n\n
\u201cI hope they get a bit of a sense of doing the right thing,\u201d Hunt said. \u201cI hope there\u2019s a sense of social good. They certainly don\u2019t get any money out of it.\u201d<\/p>\n\n\n\n
Hunt warned Congress on Thursday that there\u2019s now a \u201cperfect storm of data exposure\u201d thanks to the growth in online services that are collecting more information than they really need. He also slipped in a suggestion that that the U.S. government, like some of its counterparts elsewhere, should do more to penalize companies that don\u2019t disclose their breaches properly.<\/p>\n","protected":false},"excerpt":{"rendered":"
Working barefoot and in beachwear from his home office on Australia\u2019s Gold Coast, the amiable security researcher set up his irreverent website, \u201cHave I Been Pwned?\u201d (pronounced POHND), in 2013. Millions of people have since used the free service to see if hackers have liberated their personal details from unwary companies and posted them online.<\/p>\n","protected":false},"author":7,"featured_media":60640,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"9":{"categories":["cyber"],"primary_category":"cyber"}}},"categories":[1],"tags":[],"coauthors":[3030],"class_list":["post-19992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"acf":{"subheadline":"","legacy_arc_id":"SSQMMVLNJBAKPNB2B4QRXBVITU","arc_canonical_url":"\/civilian\/2017\/12\/05\/have-you-been-pwned-in-a-data-breach-troy-hunt-can-tell\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n