Troy Hunt

Troy Adam Hunt is an Australian web security consultant known for public education and outreach on security topics. He created and operates Have I Been Pwned?, a data breach search website that allows users to see if their personal information has been compromised. He has also authored several popular security-related courses on Pluralsight, and regularly presents keynotes and workshops on security topics.

Data breaches

As part of his work administering the Have I Been Pwned? (HIBP) website, Hunt has been involved in the publication of 644 data breaches , and journalists cite him as a cybersecurity expert and data-breach expert.

, HIBP had recorded more than 5 billion compromised user-accounts. Governments of Australia, United Kingdom and Spain use the service to monitor their official domains. Popular services, such as 1Password, Eve Online, Okta and Kogan, have integrated HIBP into their account-verification process.

Gizmodo included HIBP in its October 2018 list of "100 Websites That Shaped the Internet as We Know It".

In August 2015, following the Ashley Madison data breach, Hunt received many emails from Ashley Madison members asking for help. He criticized the company for doing a poor job informing its userbase.

In February 2017 Hunt published details of vulnerabilities in the Internet-connected children's toy, CloudPets, which had allowed access to 820,000 user records as well as 2.2 million audio files belonging to those users.

In November 2017 Hunt testified before the United States House Committee on Energy and Commerce about the impact of data breaches.

Also in November 2017 Hunt joined Report URI, a project (launched in 2015 by Scott Helme) which allows real-time monitoring of CSP and HPKP violations on a website. He planned to bring funding and his expertise to the project.

Personal data breach On 24th March 2025, Hunt was targeted via a simple phishing campaign that hijacked his Mailchimp credentials. Over 16,000 email addresses were stolen, including data associated with the Email addresses, such as geolocation and IP addresses. Hunt discovered that his credentials were stolen after clicking on the phishing email which falsely stated that his account was restricted due to reports of spam, and he was required to login to review the details. Hunt wrote on his website that "Tiredness, was a major factor. I wasn't alert enough, and I didn't properly think through what I was doing". Troy Hunt published the stolen emails on his own platform, Have I been pwned?

Additionally, Hunt works in education by speaking at technology conferences and running workshops. His primary workshop, titled Hack Yourself First, aims to teach software developers with little security background how to defend their applications by looking at them from an attacker's perspective.

Awards and achievements 2011–present: Microsoft MVP for Developer Security 2016–present: Microsoft Regional Director 2018: AusCERT's Individual Excellence in Information Security award 2018: Grand Prix Prize for the Best Overall Security Blog, The European Security Blogger Award