Welcoming Truyu to Have I Been Pwned’s Partner Program – Source: www.troyhunt.com

I always used to joke that when people used Have I Been Pwned (HIBP), we effectively said “Oh no – you’ve been pwned! Uh, good luck!” and left it at that. That was fine when it was a pet project used by people who live in a similar world to me, but it didn’t do a lot for the everyday folks just learning about the scary world of data breaches. Partnering with 1Password in 2018 helped, but the impact of data breaches goes well beyond the exposure of passwords, so a couple of months ago, I wrote about finding new partners to help victims “after the breach”, Today, I’m very happy to welcome the first such partner, Truyu.

I alluded to Truyu being an excellent example of a potential partner in the aforementioned blog post, so their inclusion in this program should come as no surprise, but let me embellish further. In fact, let’s start with something very topical as of the moment of posting:

New email from @Qantas just now: “we believe your personal information was accessed during the cyber incident”. They definitely deserve credit for early communication. pic.twitter.com/dTLlvI0Byq

— Troy Hunt (@troyhunt) July 2, 2025

It’s pure coincidence that Qantas’ incident coincides with the onboarding of an Aussie identity protection service, but it also makes it all the more relevant. My own personal circumstances are a perfect example: apparently, my name, email address, phone number, date of birth, and frequent flyer number are now in the hands of a hacking group not exactly known for protecting people’s privacy. In the earlier blog post about onboarding new partners, I showed how Truyu had sent me early alerts when my identity data was used to sign up for a couple of different financial services. If that happens as a result of the Qantas breach, at least I’m going to know about it early.

The introduction of Truyu as the first of several upcoming partners heralds the first time we’ve tailored content based on the geolocation of the user. What that means is that depending on where you are in the world, you may see something different to this:

I’m seeing Truyu on the Dropbox breach page because I’m in Australia, and if you’re not, you won’t. You’ll have your own footer with your own country, which is based on Cloudflare’s IP geolocation headers. In time, depending on where you are in the world, you’ll see more content tailored specifically for you where it’s relevant to your location. That’s not just product placements either, we’ll be adding other resources I’ll share more about shortly.

Putting another brand name on HIBP is not something I take lightly, as is evidenced by the fact this is only the second time I’ve done this in nearly 12 years. Truyu is there because it’s a product I genuinely believe provides value to data breach victims and in this case, one I also use myself. And for what it’s worth, I’ve also spent time with the Truyu team in person on multiple occasions and have only positive things to say about them. That, in my book, goes a long way.

So, that’s our new partner, and they’ve arrived at just the perfect time. Now I’m off to jump on a Qantas flight, wish me luck!