Troy Hunt's Mailchimp List data breach: 16K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2025-03-25
In March 2025, a phishing attack successfully gained access to Troy Hunt's Mailchimp account and automatically exported a list of people who had subscribed to the newsletter for his personal blog. The exported list contained 16k email addresses and other data automatically collected by Mailchimp including IP address and a derived latitude, longitude and time zone. Exposed data: email addresses, geographic locations, ip addresses, latitude and longitude pairs. The breach dates from Mar 25, 2025; Have I Been Pwned loaded it on Mar 25, 2025.
What to do
- If you had a Troy Hunt's Mailchimp List account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch
