The conundrum I refer to in the title of this post is the one faced by a breached organisation: disclose or suppress? And let me be even more specific: should they disclose to impacted individuals, or simply never let them know? I’m writing this after many recent such discussions with breached organisations where I’ve found…

I decided to write this post because there’s no concise way to explain the nuances of what’s being described as one of the largest data breaches ever. Usually, it’s easy to articulate a data breach; a service people provide their information to had someone snag it through an act of unauthorised access and publish a…

Last week, I wrote about The State of Data Breaches and got loads of feedback. It was predominantly sympathetic to the position I find myself in running HIBP, and that post was mostly one of frustration: lack of disclosure, standoffish organisations, downplaying breaches and the individual breach victims themselves making it worse by going to…

I’ve been harbouring some thoughts about the state of data breaches over recent months, and I feel they’ve finally manifested themselves into a cohesive enough story to write down. Parts of this story relate to very sensitive incidents and parts to criminal activity, not just on behalf of those executing data breaches but also very…

I hate having to use that word – “alleged” – because it’s so inconclusive and I know it will leave people with many unanswered questions. (Edit: 12 days after publishing this blog post, it looks like the “alleged” caveat can be dropped, see the addition at the end of the post for more.) But sometimes,…

Ever hear one of those stories where as it unravels, you lean in ever closer and mutter “No way! No way! NO WAY!” This one, as far as infosec stories go, had me leaning and muttering like never before. Here goes: Last week, someone reached out to me with what they claimed was a Spoutible…

Imagine you wanted to buy some shit on the internet. Not the metaphorical kind in terms of “I bought some random shit online”, but literal shit. Turds. Faeces. The kind of thing you never would have thought possible to buy online until… Shitexpress came along. Here’s a service that enables you to send an actual…

I want to try something new here – bear with me here: Data breach processing is hard and the hardest part of all is getting in touch with organisations and disclosing the incident before I load anything into Have I Been Pwned (HIBP). It’s also something I do almost entirely in isolation, sitting here on…

I found myself going down a previously unexplored rabbit hole recently, or more specifically, what I thought was “a” rabbit hole but in actual fact was an ever-expanding series of them that led me to what I refer to in the title of this post as “6 rabbits deep”. It’s a tale of firewalls, APIs…

For many years now, I’ve lamented about how much of my time is spent attempting to disclose data breaches to impacted companies. It’s by far the single most time-consuming activity in processing breaches for Have I Been Pwned (HIBP) and frankly, it’s about the most thankless task I can imagine. Finding contact details is hard.…