Lessons From Billions of Breached Records

on YouTube ↗48m

" summary

Creator of haveibeenpwned.com reports processing over 11 billion breached records across ~630 breaches and shows concrete failures: TalkTalk and Optus breaches traced to exposed backups, Australian Red Cross leak of ~1.3M donor records including blood type and sexual history, Nissan Leaf API that uses the VIN used as secret allowing remote control, and insecure kids watches (TickTock Track) where sequential family IDs let attackers track, relocate or call children; introduces Pwned Passwords as a mitigation.

AI-written summary · about

" chapters (14)

1. 0:00Intro
2. 1:30https://haveibeenpwned.com
3. 6:19How do we think of hackers?
4. 7:38TalkTalk case
5. 10:35Australian Red Cross case
6. 16:451960s
7. 18:521980s
8. 22:04MySafeP@ssw0rd!
9. 23:43Hawaii Emergency Management Agency case
10. 24:43NIST & NCSC
11. 25:44Nissan Leaf case
12. 33:41TicToc Track case
13. 45:57Padlock case
14. 47:19Outro

" related talks

• 46mKeynote: Lessons From 11 Billion Breached RecordsTroy Hunt · Black Hat Asia 2021
• 47mLessons From Billions of Breached RecordsTroy Hunt · Security Visionaries 2022
• 57mLessons From Billions of Breached RecordsTroy Hunt · Security Visionaries 2022
• 01h 02mI’m Pwned. You’re Pwned. We’re All PwnedTroy Hunt · NDC Sydney 2018
• 01h 01mThe Internet of Pwned ThingsTroy Hunt · NDC Security Oslo 2020
• 50mHave I Been Pwned?Troy Hunt · GOTO Aarhus 2023
• 59mInside the Breach: Secrets ExposedTroy Hunt · NDC Melbourne 2025
• 25mTopics of Interest: An Attackers View on APAC's 2021 Three Major BreachesRic Campo · OWASP 20th Anniversary 2021