troyhunt-com

In this weekly update recorded from a riad in Marrakech, Troy Hunt discusses the futility of trying to delete personal data from the internet, comparing it to removing urine from a swimming pool, while covering recent data breaches.

Troy Hunt discusses the difficulty of permanently deleting personal data from the internet, using the analogy of trying to remove urine from a swimming pool—once data is out there, it's nearly impossible to completely erase. He explains the technical and practical challenges of data removal, including backups, archives, and third-party copies.

Troy Hunt records his weekly update live from Mallorca with Scott Helme, reflecting on the 8-year anniversary of their "Why no HTTPS?" project, which was created to call out companies for failing to implement proper transport layer security.

The article discusses the concept of conscious incompetence in home cinema audiovisual knowledge, distinguishing it from unconscious incompetence, without derogatory intent toward those less informed on the topic.

Troy Hunt discusses the recent ShinyHunters data breaches, noting both the criminal activity itself and the varied responses from affected organizations, including a frequent lack of disclosure to victims. He observes the patterns of appearance and disappearance of breached data.

Troy Hunt has loaded the 1,000th data breach into Have I Been Pwned, prompting him to question why the service is still necessary given the existence of privacy regulations.

The Philippines has become the 46th government to join Have I Been Pwned's free government service. The country's National CERT, in partnership with the Department of Information and Communications Technology, can now monitor official government domains against data breaches tracked by HIBP to enhance cybersecurity.

Troy Hunt announces that Have I Been Pwned has reached 1,000 data breaches, highlighting the extensive behind-the-scenes work involved beyond just processing data, including legal documents, trademarks, accounting, and agreements.

Troy Hunt shares his frustration over the difficulty of finding attractive, non-stateful push-button light switches that meet his simple criteria.

The Bhutanese government, through its Computer Incident Response Team (BtCIRT), has joined Have I Been Pwned's free government service as the 45th government onboarded. BtCIRT now monitors Bhutanese government domains against the data in HIBP.

Troy Hunt reports that ShinyHunters have gone silent following the massive Instructure ransom haul, two weeks after he first heard rumors of payment being made.

In Weekly Update 504, Troy Hunt discusses the debate over whether to pay or not pay hackers who threaten to leak stolen data, noting that Grafana recently chose the "no pay" approach.

The Bahamas has become the 44th government to onboard to Have I Been Pwned's free government service. The country's National Computer Incident Response Team, CIRT-BS, now has access to monitor government domains against the data breach database.

Bangladesh has become the 43rd national government to join Have I Been Pwned's free government service. The BGD e-GOV CIRT department now has API access to monitor all government domains for data breaches.

The Costa Rican government, through its CSIRT, has become the 42nd government to join Have I Been Pwned's free service, gaining access to monitor government domains for data breaches and exposure.

Troy Hunt reports that Instructure has not been re-added to the ShinyHunters leak site ahead of the "pay or leak" deadline, instead displaying only a press statement saying the company will not comment further.

ShinyHunters, a group with limited resources typically made up of teenagers to early 20s, consistently gains access to data from massive brands through leverage rather than just technical ingenuity alone.

Troy Hunt published Weekly Update 501, discussing a tongue-in-cheek equality policy for treating an AI bot with the same respect as human colleagues, highlighting evolving workplace norms around AI in 2026.

Troy Hunt reflects on reaching his 500th weekly update video, noting that an audience question about happiness resonated most. He acknowledges that he and his wife Charlotte have chosen a non-traditional, intense, and sometimes stressful path without clear work-life boundaries.

Troy Hunt joked about Scott Helme receiving AI-generated responses to his solar system cost analysis, but instead Hunt himself received such AI-slop responses to his own post.

The article discusses reactions in the UK to impending social media bans for those under 16, noting concerns about government ID collection and data privacy implications.

Troy Hunt is in Hong Kong where he presented at INTERPOL's Cybercrime Expert Group. He plans to expand on key takeaways from the event in his weekly update.

Troy Hunt thanks readers for helping troubleshoot a problem with his new PC's Print Screen button, which refused to bind to SnagIt software despite their efforts.

The ESP32 Bluetooth bridge experiment failed because the Yale locks could not be reliably operated via BLE, which appears to be too passive to detect the locks properly.

This week's update focuses on the delay between data breaches occurring and individuals learning about them. While companies face criminal intrusions and ransom demands, there's often a significant gap before affected people are notified.

The Odido breach leaks occurred during the week's update, with multiple data dumps being released over consecutive days. A second dump hit one day, followed by a third dump hours later, and a final comprehensive dump the next day.

Troy Hunt reports that his Have I Been Pwned service has loaded 959 breaches since starting over a decade ago, averaging one breach every 4.7 days. Last week saw an unusual spike with five breaches loaded in just two days.

The weekly update discusses how the platform has evolved from a simple website and database to include serverless functions, edge computing, new data storage structures, and different query mechanisms for email address searches.

The article describes OpenClaw as having early-stage potential similar to the first airplane, noting it appears rudimentary but could represent the beginning of agentic AI transforming the world.

Have I Been Pwned has expanded significantly from a hobby project to a major service handling hundreds of millions of password searches daily. The platform now supports passkeys, k-anonymity searches, speed enhancements, and a bulk domain verification API.