Troy Hunt's Mailchimp List Data Breach (2025): What Was Exposed & What To Do

In March 2025, a phishing attack compromised Troy Hunt's Mailchimp account, leading to the automatic export of a subscriber list from the newsletter for his personal blog. The incident, reported on March 25, 2025, affected approximately 17,000 people and exposed email addresses along with related location and network data collected by the platform.

Public details confirm that the exported list included around 16,000 email addresses plus automatically gathered information such as IP addresses and derived geographic coordinates. This matters because the list belonged to a well-known cybersecurity figure, meaning many subscribers may already be security-conscious yet still face risks from the exposed contact and location details.

Inside the incident

According to the reported summary, attackers used phishing to gain access to Troy Hunt's Mailchimp account in March 2025. Once inside, they triggered an automatic export of the full list of people who had subscribed to the newsletter for his personal blog. The export contained roughly 16,000 email addresses and other data that Mailchimp collects by default, including IP addresses and derived latitude, longitude and time-zone information. Geographic locations were also among the data types named as exposed. The total number of people affected is given as 17,000. No further technical details about the phishing message, the exact duration of access, or any subsequent use of the data have been disclosed in the available record.

How a breach like this happens

Incidents of this type typically begin with a carefully crafted phishing message that impersonates a trusted service or colleague. The message aims to trick the account holder into entering credentials on a fake login page or approving a malicious session. Once the attacker obtains valid credentials or a session token for a marketing platform such as Mailchimp, they can log in as the legitimate user and use the platform's built-in export functions. These platforms often store subscriber lists together with automatically captured metadata—IP addresses, timestamps and approximate locations—so a single successful login can yield a ready-made file containing both contact details and location-related data. Because the export feature is a normal administrative tool, the activity may not immediately trigger alerts if the attacker stays within the account's usual permissions. No specific threat group has been attributed in the public facts for this case.

About Troy Hunt's Mailchimp List

Troy Hunt is a prominent cybersecurity researcher and educator best known for creating the Have I Been Pwned service, which helps people check whether their email addresses have appeared in known data breaches. His personal blog and associated newsletter serve as channels for sharing security research, breach analyses and practical advice with a global audience of security professionals, journalists and interested members of the public. The Mailchimp list in question was simply the subscriber roster for that newsletter. Organisations and individuals who run newsletters of this kind routinely hold email addresses and the technical metadata that email-marketing platforms collect automatically. A breach of such a list is consequential because the subscribers are often people who follow security topics closely; exposure of their contact details can undermine trust and create opportunities for more targeted phishing or social-engineering attempts that reference the very community they belong to.

The information in question

The facts name the following data types as exposed: email addresses, geographic locations, IP addresses, and latitude and longitude pairs. The reported summary adds that the exported list contained approximately 16,000 email addresses together with other data automatically collected by Mailchimp, including IP address and a derived latitude, longitude and time zone. Exact contents beyond these categories remain limited to what has been publicly stated; no additional fields such as names, phone numbers or payment information are mentioned in the available record.

What's at stake

For the people whose details were exported, the primary risks are secondary phishing and social-engineering attacks that use the known email address and approximate location to appear more credible. An attacker who knows both an email address and a rough geographic area can craft messages that reference local events or services, increasing the chance that a recipient will engage. IP addresses and coordinate pairs can also help map patterns of activity or confirm that a particular address belongs to a real person. For the organisation itself—in this case a personal newsletter list—the exposure can damage subscriber confidence and require additional communication and monitoring effort. Because the list was relatively modest in size, the absolute scale of risk is limited compared with large commercial breaches, yet the specialised nature of the audience means the data may still hold value for targeted campaigns.

What to do if you're exposed

If you subscribed to Troy Hunt's personal-blog newsletter, treat the associated email address as potentially compromised. Change any passwords that might have been reused on other services, enable multi-factor authentication wherever possible, and remain alert for unexpected messages that reference security topics or claim to come from familiar sources. Monitor financial and account activity for unusual behaviour. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Staying cautious with unsolicited links and verifying unexpected requests through separate channels remain the most practical next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.