Troy Hunt's breach counter hits 1,000 as disclosure lags stretch

Have I Been Pwned now lists 1,003 breached sites and 17.6B pwned accounts, with recent Carnival and Zara notices arriving weeks after public leaks.

By · Published

Primary source: Troy Hunt

Why it matters

HIBP's 1,000-breach milestone shows that breach response still has a timing failure: stolen data can circulate for weeks before victims receive official notice.

Illustration of Troy Hunt's Have I Been Pwned breach counter showing 1,000, surrounded by symbols of delayed disclosure and scattered compromised account records, referencing Carnival and Zara.

Troy Hunt (@troyhunt) has loaded the 1,000th data breach into Have I Been Pwned, the breach search and alert service he has run since 2013, and used the milestone to make a sharper point: victims are still learning about exposed data from leak sites and third-party services before they hear from the companies that lost it.…

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Reader comments

Conversation for this story loads after sign-in.