troyhunt-com

The Bhutanese government, through its Computer Incident Response Team (BtCIRT), has joined Have I Been Pwned's free government service as the 45th government onboarded. BtCIRT now monitors Bhutanese government domains against the data in HIBP.

Troy Hunt reports that ShinyHunters have gone silent following the massive Instructure ransom haul, two weeks after he first heard rumors of payment being made.

In Weekly Update 504, Troy Hunt discusses the debate over whether to pay or not pay hackers who threaten to leak stolen data, noting that Grafana recently chose the "no pay" approach.

The Bahamas has become the 44th government to onboard to Have I Been Pwned's free government service. The country's National Computer Incident Response Team, CIRT-BS, now has access to monitor government domains against the data breach database.

Bangladesh has become the 43rd national government to join Have I Been Pwned's free government service. The BGD e-GOV CIRT department now has API access to monitor all government domains for data breaches.

The Costa Rican government, through its CSIRT, has become the 42nd government to join Have I Been Pwned's free service, gaining access to monitor government domains for data breaches and exposure.

Troy Hunt reports that Instructure has not been re-added to the ShinyHunters leak site ahead of the "pay or leak" deadline, instead displaying only a press statement saying the company will not comment further.

ShinyHunters, a group with limited resources typically made up of teenagers to early 20s, consistently gains access to data from massive brands through leverage rather than just technical ingenuity alone.

Troy Hunt published Weekly Update 501, discussing a tongue-in-cheek equality policy for treating an AI bot with the same respect as human colleagues, highlighting evolving workplace norms around AI in 2026.

Troy Hunt reflects on reaching his 500th weekly update video, noting that an audience question about happiness resonated most. He acknowledges that he and his wife Charlotte have chosen a non-traditional, intense, and sometimes stressful path without clear work-life boundaries.

Troy Hunt joked about Scott Helme receiving AI-generated responses to his solar system cost analysis, but instead Hunt himself received such AI-slop responses to his own post.

The article discusses reactions in the UK to impending social media bans for those under 16, noting concerns about government ID collection and data privacy implications.

Troy Hunt is in Hong Kong where he presented at INTERPOL's Cybercrime Expert Group. He plans to expand on key takeaways from the event in his weekly update.

Troy Hunt thanks readers for helping troubleshoot a problem with his new PC's Print Screen button, which refused to bind to SnagIt software despite their efforts.

The ESP32 Bluetooth bridge experiment failed because the Yale locks could not be reliably operated via BLE, which appears to be too passive to detect the locks properly.

This week's update focuses on the delay between data breaches occurring and individuals learning about them. While companies face criminal intrusions and ransom demands, there's often a significant gap before affected people are notified.

The Odido breach leaks occurred during the week's update, with multiple data dumps being released over consecutive days. A second dump hit one day, followed by a third dump hours later, and a final comprehensive dump the next day.

Troy Hunt reports that his Have I Been Pwned service has loaded 959 breaches since starting over a decade ago, averaging one breach every 4.7 days. Last week saw an unusual spike with five breaches loaded in just two days.

The weekly update discusses how the platform has evolved from a simple website and database to include serverless functions, edge computing, new data storage structures, and different query mechanisms for email address searches.

The article describes OpenClaw as having early-stage potential similar to the first airplane, noting it appears rudimentary but could represent the beginning of agentic AI transforming the world.

Have I Been Pwned has expanded significantly from a hobby project to a major service handling hundreds of millions of password searches daily. The platform now supports passkeys, k-anonymity searches, speed enhancements, and a bulk domain verification API.

The weekly update discusses progress with OpenClaw, noting that the team is finding the right balance between human tasks and automated agent functions, with an increasing shift of workload to the automated system.

This week's update focuses on the challenges of chasing overdue invoices from a customer with payments more than six months late, despite agreed payment terms.

Troy Hunt discusses his growing appreciation for his AI assistant Bruce, noting that it's not just about fully autonomous ticket responses but also excels at responding with minimal human input.

Troy Hunt demonstrates how agentic AI can leverage Have I Been Pwned's APIs to perform automated security checks and data analysis. The technology can process breach data to identify compromised credentials and provide actionable security insights.