Ask HN: Found a leak of US citizens personal data. Should I report it?

You could also check https://iapp.org/resources/article/state-data-breach-notific... and report it to state authorities in the relevant states (whichever you think those are). These notifications are usually supposed to be made by the company responsible for the data breach, but I imagine some of the state authorities would be interested to get a third-party report too.

Please do not ever communicate directly with anyone from a federal law enforcement agency. Only talk to them through an attorney. They are most definitely not on your side.

There are so many possible bad outcomes that can result from these options. Not a good idea at all imho.

Unfortunately, Brian Krebs did not answer for a week. Started thinking data leak is not a super interesting topic for professionals. It happened every week, so my discovery is just another data leak.

I absolutely agree. It is unlikely that I will be thanked for such an act.

Destroy the reputation of a company with 10+ years of experience on the market. And force dozens of other companies across the U.S. to apologize to their customers for leaking data.

Not to mention lawsuits and fines for such a leak.

Probably the best advice in this thread so far (better than mine, I think, at least) is

https://news.ycombinator.com/item?id=34934091

It's an approach that's specifically calculated to minimize the blowback.

Proceed anonymously. Make sure the cost to identify you exceeds the theoretical damage of the hack.

> there is no upside in you reporting the leak

There is - not letting it be - raising awareness and contributing to prevention of a normalization of such things. If everyone would hold "let sleeping dogs lie"/"not my circus, not my monkeys" attitude it would gradually become a norm and this benefits no one (but possibly bad actors).

However, exercising caution never hurts, so it shouldn't be a bad idea to reach out anonymously and explicitly state that you have nothing to do with the issue at hand and merely an observer who had noticed its existence. Doing so through a trusted third party who are experienced (many names in comments already) with handling such situations is probably the best approach.

Burner phone? Those only exist in the movies, like pew-pew silencers. In real life, mobile telecommunication systems are some of the most easily traced systems of all. Anonymous email like ProtonMail, sent from a free VPN using a downtown Starbucks free WiFi would be far, far more opsec-friendly.

Unfortunately, they did not answer for a week. Started thinking data leak is not a super interesting topic for professionals. It happened every week, so my discovery is just another data leak.

I came into here to offer the same advice, that's exactly what their specialty is.

Telling divd.nl (Dutch Institute for Vulnerability Disclosure) can be a good option too.

Or use one of the organizations that have a secure drop instance running [0]

[0] https://securedrop.org/directory/

Unfortunately, he did not answer for a week. Started thinking data leak is not a super interesting topic for professionals. It happened every week, so my discovery is just another data leak.

Proton isn’t an anonymity silver bullet, and, as others have indicated, your opsec is generally worse than you believe it to be anyway.

Also, to have your first contact with the company be “I’ve found a problem and I want money” might get Legal rather than IT involved, and then you’re on the back foot.

Isn’t any group “vulnerable”? What does that word even mean?

Doesn't seem like a widely used convention.

https://www.netflix.com/security.txt exits, but Apple, Google, Microsoft, and Meta don't have one.

it's because the patients are running the sanitarium here.

the typical cost of legal actions pursuant to a data breach are so low, it doesn't make dollars or sense to give a shit about customer infosec.

It's not like we don't have perfectly capable people, or that the companies in question don't care about information security in general. For example, it's exceedingly rare to see a data leak that makes individuals or institutions look bad from a PR standpoint (like Snowden).

But customer data? why bother? what, are they gonna slap us with a million dollar class action? I'm quaking so hard in my boots my multibillion market cap is gonna fall off.

Just send from an email not under your real name.

Further, I am not sure the company can prove this is unauthorized access when they provide the data without requiring authentication (through negligence). They could claim, we made it open to public but the public is not supposed to download it, but this is a difficult claim, eg, it should have been clearly stated in their website at minimum. It’s a bit like public photography.

Depends on how good OP's opsec is as a security researcher. If they're any good, they should know what traces they left. Did they use a VPN via a coffee shop's wifi, or did they connect from home. Canada is a different country from the US though, so it might be time for them to lawyer up and see how extradition works for CFAA violations.

This is so weird to read...

"In the US/Canada things are like this. It sounds like it's China."

It's literally not China, but the US/Canada. It sounds like the US/Canada. Because it is.

At best you get a pat on your back, at worst you go to jail: why should anyone take the chance?

These comments are doom and gloom from people who have read articles but haven't been there. I've crossed the local railway tracks, blindfolded and earmuffed, for over a dozen times, and not once has a train hit me. If you're worried, contact a random australian dude working for one of the biggest cybersecurity threats on the planet, who also seems to pass time by counting cars that pass over a nearby bridge, and have him be an intermediary for you, as others have suggested. It will be great!

Unfortunately, he did not answer for a week. Started thinking data leak is not a super interesting topic for professionals. It happened every week, so my discovery is just another data leak.