Inside LeakedSource and Its Database of 3 Billion Hacked Accounts

“While this project began as a hobby it has also turned into a very crucial public service and we believe we’ve educated much of the general public on the poor state of internet security,” the group explains in a FAQ published on Monday. “As an added bonus, we force the hands of breached companies to actually notify their users instead of sweeping it under the rug which [we] accomplish by notifying media outlets.”

Importantly, LeakedSource says that it only publishes information that is already publicly available online, and doesn’t publish data that hasn’t been posted anywhere else. A spokesperson also said that LeakedSource doesn’t pay for data dumps. “Over two billion of ‘our’ records are literally a Google search away. Go ahead and Google ‘download myspace database’ and it’ll be in the top five results, for example,” the representative says. “All we do is combine it in one easy to use location.” Records that aren’t obtained from the mainstream web come from “underground groups.” The service has operated for a little more than a year at this point, and LeakedSource says that it has had no interactions of any kind with law enforcement thus far.

Public Service (For Some Profit)

Its business model is not without controversy, though. The group doesn’t just maintain the databases, it also decrypts passwords and other data that comes out of hacks when possible. In one sense, that makes LeakedSource’s offerings more useful to companies and users alike, since it lets both search for specific data. LeakedSource says it offers this mechanism to, “satiate [user] curiosity which is a natural human tendency. For example if it’s not enough that we tell you your username was leaked from MySpace, for a couple dollars we’ll tell you WHICH username was leaked or which email, etc.”

It also, enables queries for other people’s information as well as your own. For people who rotate between a few passwords it’s useful to be able to look up which one was compromised in a breach; that way you know which other accounts you need to adjust and monitor, and which can stand pat. But offering such a service does create another public channel for would-be attackers to access the information, and some in the security community argue that LeakedSource is profiting off of breaches while possibly making security problems worse by doing all the work to groom leaked data.

“They’re basically trying to make some money off public information in a way that aids and abets crime in my opinion,” says John Michener, chief scientist at the security consulting firm Casaba Security. “There’s a lot of value to people knowing they’ve been popped, so if [LeakedSource] were serious about the public benefit part of it they could just send emails to every compromised email saying ‘hey, we picked you up in a compromised database.’ ”

The LeakedSource spokesperson says that the service’s operating costs “exceed the salary of most normal jobs so there has to be some sort of revenue or it just couldn’t function.”

The anonymity, too, has spawned concerns over accountability.

“There are other services like this that I would say are a little more reputable, because you know who’s running them and you know they’re making their money doing something else,” says Jared DeMott, the chief technical officer of the managed security company Binary Defense Systems. “With this one I’m hesitant to even punch my email into it because I don’t know who’s running it and what they do with that data. I think that’s probably why they want to hide because they understand that the data they’re holding is in a very foggy area ethically even though there is a big need for it and there’s a market for it.”

LeakedSource says that “under no circumstances” does it sell data about what people search for on its site. “Unlike free websites we don’t pay our bills with your information, you aren’t the product here,” the group says. It’s also adamant that its motives are completely apolitical. “It is demonstrably hazardous to one’s health to have a political agenda these days,” the spokesperson said, adding that when people try to leak sensitive data, such as government information, to LeakedSource, the group redirects would-be leakers “to more suited organizations such as Wikileaks.”

A Net Good

Despite unease from some corners, LeakedSource has its backers as well. The group says it has collaborated with reporters in the past to unearth breaches, rather than log into or probe services on its own. And it even has an advertiser in Netsparker, a UK-based company that develops a web application security scanner. “Quite frankly, even we don’t know their names” says Robert Abela, marketing manager at Netsparker. “But they’re not doing anything illegal, and if they want to remain anonymous that’s their own business question…As long as they’re providing a good service to the community and raising awareness, we’re behind them.”

It’s also far from the only service providing information about the data in big breaches. Instead, it’s part of what is hopefully a movement to create more tools that help consumers understand the status of their personal data and feel more empowered to defend it. The recent Yahoo breach, which included one billion user records stolen in 2013, is a reminder that the scale of individual breaches is firmly in the billions.