Troy Hunt

Troy Adam Hunt (born 1976) is an Australian web security consultant, Microsoft Regional Director, and Microsoft MVP for Developer Security best known as the creator of Have I Been Pwned (HIBP), the free breach-notification search service he launched on December 4, 2013. Based on the Gold Coast, Queensland, Hunt has spent more than a decade turning a personal side project into one of the most widely used and widely trusted tools in consumer and enterprise data-breach response.

Background

Hunt began web development in 1995, working across Australia and the United Kingdom before joining the pharmaceutical company Pfizer in Sydney in 2001. Over 14 years there he progressed from developer to software architect, managing software delivery across the Asia-Pacific region for systems covering clinical trials, patient safety reporting, and sales-force operations. During this period he also built ASafaWeb, an automated security-scanning tool for ASP.NET websites, and became increasingly active writing and speaking about web application security. He left Pfizer in 2015 to focus full-time on independent security work and HIBP.

Creating Have I Been Pwned

In late 2013, Hunt was analyzing patterns across recent data breaches when the Adobe Systems breach of October 2013 — which exposed approximately 153 million accounts and included both his own email address and one belonging to Pfizer, tied to Adobe's earlier acquisition of Macromedia — convinced him that ordinary users had no easy way to know whether their own data had been exposed. He built and launched Have I Been Pwned on December 4, 2013, indexing just five breaches at launch: Adobe, Stratfor, Gawker, Yahoo! Voices, and Sony Pictures. The name adopted the hacker slang term "pwned," and the site let anyone enter an email address to check it against known breach dumps for free.

Growth and Impact

HIBP grew rapidly through subsequent years as major breaches surfaced: by June 2019 the service was handling roughly 160,000 daily visitors, had close to three million active email-notification subscribers, and indexed nearly eight billion account records. In 2017, Hunt added Pwned Passwords, a searchable database of hundreds of millions of previously breached passwords; in February 2018 he introduced a k-anonymity protocol that let services check a password's exposure without ever transmitting the full password or hash to HIBP's servers, a privacy model subsequently echoed by Google's Password Checkup feature. By 2018 Hunt was also running the site largely alone; his wife Charlotte joined in 2021 to handle business operations, and Icelandic developer Stefán Jökull Sigurðarson began contributing part-time development work the same year. In 2019, facing burnout and personal financial pressure from a divorce, Hunt publicly explored selling HIBP under the codename "Project Svalbard," holding talks with several prospective corporate acquirers; the deal ultimately collapsed in 2020 due to a change in the buyer's business circumstances, and Hunt subsequently committed to keeping the project independent, later open-sourcing parts of its codebase starting in 2021.

Notable Breaches Surfaced

Over the years HIBP became the reference point for numerous major disclosures, including the 2013 Adobe breach that inspired its creation; the 2015 Ashley Madison breach, which exposed more than 30 million user accounts from the affair-oriented dating site and drove a roughly 57,000% spike in HIBP traffic; and, in January 2019, "Collection #1," a 87GB compilation of 772,904,991 unique email addresses and over 21 million unique passwords aggregated from thousands of earlier breaches, which Hunt was the first to publicly report after being alerted to files circulating on the cloud storage service Mega. HIBP has also indexed breaches including MySpace (360 million accounts), LinkedIn (164 million), Tumblr (65 million), and VK/VKontakte (171 million), among hundreds of others.

Microsoft Regional Director and Education Work

Hunt has held the Microsoft MVP for Developer Security award since 2011 and became a Microsoft Regional Director in 2016. He is a prolific security educator, having authored dozens of courses for Pluralsight covering topics such as the OWASP Top 10, HTTPS, browser security, and ethical hacking, and running a hands-on workshop called "Hack Yourself First" that teaches developers to think like attackers. In November 2017 he testified before the United States House Committee on Energy and Commerce about the impact of data breaches on consumers. HIBP's breach-checking API has been integrated into major consumer security tools, including Mozilla's Firefox Monitor (2018) and 1Password's Watchtower feature (2018), and the site has been adopted for domain monitoring by national government computer emergency response teams (CERTs) in dozens of countries, including Australia, the UK, and Spain.

Recent Developments

Since 2021, both the FBI and the UK's National Crime Agency have fed compromised password data directly into HIBP's Pwned Passwords database through a dedicated law-enforcement ingestion pipeline, supplying hashed (not plaintext) credentials recovered during investigations; in 2024, data recovered from law-enforcement botnet takedowns under "Operation Endgame" — roughly 16.5 million email addresses and 13.5 million unique passwords — was loaded into HIBP through this same pipeline. In March 2025, Hunt himself was compromised by a phishing email impersonating Mailchimp, which tricked him into entering his credentials and a one-time passcode on a fake login page; the attackers exported a mailing list of roughly 16,000 subscriber email addresses tied to his personal blog, though HIBP's core breach-search service itself was not affected. Hunt disclosed the incident publicly and added it, transparently, as its own listed breach on HIBP.

Timeline

• 1976Born in Australia.
• 2001Joins Pfizer in Sydney, eventually becoming a software architect over 14 years there.
• 2011Named a Microsoft MVP for Developer Security.
• 2013-12-04Launches Have I Been Pwned, indexing five initial breaches including Adobe and Gawker.
• 2015Leaves Pfizer to work independently on security consulting and HIBP; Ashley Madison breach drives major traffic growth to the site.
• 2016Becomes a Microsoft Regional Director.
• 2017-11Testifies before the U.S. House Committee on Energy and Commerce on the impact of data breaches.
• 2018HIBP's breach-checking API is integrated into Mozilla's Firefox Monitor and 1Password's Watchtower; introduces k-anonymity model for Pwned Passwords.
• 2019-01First reports the 773-million-record 'Collection #1' data breach compilation.
• 2019-06Publicly announces 'Project Svalbard,' an attempt to sell HIBP amid personal and professional burnout.
• 2020-03Sale of HIBP falls through; Hunt commits to keeping the project independent.
• 2021Begins open-sourcing parts of HIBP's codebase; wife Charlotte Hunt joins to run business operations.
• 2024Law-enforcement 'Operation Endgame' botnet takedown data (16.5 million emails, 13.5 million passwords) is loaded into HIBP via the FBI/NCA ingestion pipeline.
• 2025-03Falls victim to a Mailchimp-impersonating phishing attack that exposes roughly 16,000 of his own blog's subscriber email addresses.