Troy Hunt's Mailchimp List Data Breach

What happened

In March 2025, a phishing attack successfully gained access to Troy Hunt's Mailchimp account and automatically exported a list of people who had subscribed to the newsletter for his personal blog. The exported list contained 16k email addresses and other data automatically collected by Mailchimp including IP address and a derived latitude, longitude and time zone.

Exposed data

Recommended actions

• Watch for targeted phishing emails referencing Troy Hunt's Mailchimp List — attackers weaponise breach data quickly.
• Check whether your email address appears in this breach on haveibeenpwned.com.