Have You Been ‘PWNED' In A Data Breach? Troy Hunt Can Tell

Troy Hunt has collected a trove of 4.8 billion stolen identity records pulled from the darkest corners of the internet — but he isn’t a hacker.

Instead, he uses that repository to help ordinary people navigate the growing scourge of the corporate data breach. All that personal information was originally taken from brand name services such as LinkedIn, Kickstarter, Dropbox, MySpace and the cheating website Ashley Madison, and later assembled by Hunt.

Working barefoot and in beachwear from his home office on Australia’s Gold Coast, the amiable security researcher set up his irreverent website, “Have I Been Pwned?” (POHND), in 2013. Millions of people have since used the free service to see if hackers have liberated their personal details from unwary companies and posted them online.

Along the way, Hunt has become a close student of data breaches and the slipshod security that makes many companies easy prey for attackers. He’s exposed several such thefts himself, in some cases identifying them before the companies themselves did.

AN EPIDEMIC OF PWNAGE

“Pwned” — a deliberate misspelling of “owned” — is slang used by gamers to mean “utterly defeated.” It’s an apt description of what it’s like to have criminals use your Social Security number, birthdate and other personal details to commit fraud in your name.

Hunt was invited to appear before Congress in late November to help lawmakers wrestle with this growing crisis of consumer data theft. In just the past two years, attackers have stolen sensitive information about hundreds of millions of people from the credit bureau Equifax, popular online services such as Uber and too many other companies to count.

Much of that stolen data flows directly into the black market. “Data breaches are another commodity, like heroin,” Hunt testified Thursday before the House Energy and Commerce Committee.

UNLIKELY MESSENGER