Troy Hunt obtained a copy and worked through it. The set resolved to about 2.7 billion rows and 134 million unique email addresses. Multiple rows referenced the same person.
Other analysts noted the structure gave the illusion of billions of records without containing billions of people, and that the set included many deceased individuals — some dead for two decades.
Rows Are Not Records And Records Are Not People
This corpus keeps repeating that distinction because it is where almost every headline figure goes wrong. A row is one line in an export. A person may appear on dozens of them: one per address they have lived at, one per data source, one per spelling.
The gap between 2.7 billion rows and 134 million unique email addresses is roughly twenty to one. It is the largest such gap this database has documented.
The Dead Are The Detail Worth Keeping
A file containing people who died twenty years ago is not a file that was being maintained. It is an accumulation, appended to and never reconciled, sold as current.
That is a finding about the broker rather than about the breach, and it is arguably the more serious one. The product’s value proposition was accuracy about people, and the product contained people who no longer exist.
Untraceable Provenance
The analysis described the set as assembled by scraping publicly available data from countless — and now untraceable — sources, mixing useful material with incorrect and redundant material.
So an affected person cannot find out where their record came from, cannot correct it, and cannot establish which of the many rows bearing their name are actually theirs. The corpus recorded at 25-1219 that no mechanism connects a breach to a subsequent harm; here no mechanism connects a person to their own data.
Graded high: the analysis is published, reproducible in method, and was corroborated by other researchers working from the same set.
Based on the published analysis of the leaked set by Troy Hunt and corroborating researcher commentary, listed below. This desk has not obtained or examined the data. The row, address and duplication figures are as published by the analysing researcher. Graded high on the strength of an independent examination whose method is described. Corrections: corrections@forensicpost.com.