Have I Been Pwned? DEVELOPED_BY Troy Hunt
Troy Hunt says he runs the data breach notification service Have I Been Pwned?
Explicit Confidence 99% · Troy Hunt EP 33 Details
“I run the data breach notification service Have I Been Pwned?”
Episode
05 March 2019 Official episode · Official transcript
cybercrime research
The episode examines the 2009 RockYou data breach, in which approximately 32 million plaintext passwords were exposed, and its lasting impact on password-cracking research and defensive security practices.
Topics: SQL injection, Unsanitized user input, Plaintext password storage, Password hashing, Password cracking, Brute-force attacks, Password reuse, Credential theft, Data breach disclosure, Web application security, Security auditing, Children’s data protection
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Have I Been Pwned? DEVELOPED_BY Troy Hunt
Troy Hunt says he runs the data breach notification service Have I Been Pwned?
Explicit Confidence 99% · Troy Hunt EP 33 Details
“I run the data breach notification service Have I Been Pwned?”
Have I Been Pwned? CONTAINS RockYou
The website is described as collecting and publishing public and semi-public breach data, including breach details such as RockYou.
Derived Direction flagged Confidence 78% · Jack Rhysider EP 33 Details
“He collects all the breach data and puts it into his database”
Tom used BayWords to publish posts about websites he had hacked.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“So he gave BayWords a try. BayWords was a simple blogging platform”
Tom EXPLOITS SQL injection vulnerability
Tom tested websites for SQL injection and exploited the vulnerability in csfd.cz and later rockyou.com.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“Tom saw this website was vulnerable to SQL injection and started seeing what kind of fun he could have.”
“He immediately started checking for himself and sure enough he was able to get right in”
Tom USES SQL injection
Tom used SQL injection through website login fields to query databases and obtain user data.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“he could issue SQL commands and query the database [00:10:00] right through the username field of the login page”
RockYou INITIAL_ACCESS_VIA SQL injection
The RockYou breach began through a SQL injection vulnerability in rockyou.com.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“rockyou.com was vulnerable to SQL injection”
The RockYou incident involved unauthorized access to and theft of RockYou's user database.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“Tom posts to his blog saying that he’s taken 32 million accounts from the rockyou.com website”
RockYou INVOLVES SQL injection vulnerability
The breach involved RockYou's SQL injection vulnerability, which was later fixed after notification.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“They worked all weekend to resolve this SQL injection on their site”
Imperva was involved when a security researcher at the company warned RockYou about the vulnerability.
Explicit Confidence 98% · Jack Rhysider EP 33 Details
“a security researcher at Imperva saw the forum post that rockyou.com was vulnerable to a SQL injection”
SQL injection vulnerability DISCOVERED_BY Imperva
A security researcher at Imperva identified the SQL injection vulnerability and notified RockYou.
Explicit Confidence 93% · Jack Rhysider EP 33 Details
“He notified RockYou of this vulnerability”
SuperWall DEVELOPED_BY RockYou
RockYou built the SuperWall Facebook application.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“they built a Facebook app called SuperWall back in 2007”
RockYou built and operated applications integrated with Facebook, including SuperWall.
Explicit Confidence 95% · Jack Rhysider EP 33 Details
“They were also making social media games, too. They were killing it on Facebook and MySpace”
RockYou applications required users to log in to MySpace, and RockYou stored those MySpace credentials.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“RockYou would capture these MySpace logins and store them on their own site again in clear text”
RockYou USES Plaintext password storage
RockYou stored user passwords and social-media credentials in clear text rather than hashing or encrypting them.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“RockYou had been storing the user passwords in clear text”
RockYou CONTAINS RockYou password list
The breach data was used to create a file containing all 32 million extracted passwords.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“He extracted only the passwords out of the dump, all 32 million of them, and put them in a text file.”
Tom USES RapidShare
Tom uploaded the extracted RockYou password list to RapidShare.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“He posted this to RapidShare, a popular file sharing site”
Amichai Shulman MEMBER_OF Imperva
Amichai Shulman says he was working with Imperva by 2009 and had co-founded the company.
Explicit Confidence 99% · Amichai Shulman EP 33 Details
“by 2009 I was working with Imperva, a company that I founded in 2002”
Amichai Shulman MEMBER_OF Unit 8200
Amichai Shulman says he spent eight years in Unit 8200, the Israeli military division.
Explicit Confidence 96% · Amichai Shulman EP 33 Details
“I spent eight years in the military”
“he started out in Unit 8200, the secret Israeli military division”
Kali Linux USES RockYou password list
Kali Linux is described as including the RockYou password list by default.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“Kali Linux, a popular hacking operation system, comes with the RockYou password list on it by default”
RockYou USES Password hashing
After the breach, RockYou began hashing its passwords.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“They started hashing their passwords after that, too.”
RockYou INVOLVES Children’s Online Privacy Protection Act
The FTC determined that RockYou's handling of children's data violated requirements under COPPA.
Explicit Confidence 98% · Jack Rhysider EP 33 Details
“The FTC determined that RockYou had known that children were users on the site and they didn’t protect their data which put them in violation of these rules.”
RockYou INVOLVES Federal Trade Commission
The Federal Trade Commission investigated the breach and fined RockYou over its handling of children's records.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“The FTC investigated the breach and found that RockYou had stored almost 180,000 children’s records”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T05:33:58.589614+00:00