An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!
Enjoy!
So “technically” I don’t think downloading breach data would be legal in the U.S. at all. It’s essentially possession of stolen property.
I’m not a lawyer, but trafficking in stolen account dumps just doesn’t seem like something “reputable” sites want to do, which is why you’re normally stuck with the shady stuff.
Caveat: I could be entirely wrong about this.
There have been several sites in the past that allowed you to download confirmed breached dbs and not sites like raidforums.
There is a list of laws here: https://www.ncsl.org/technology-and-communication/security-breach-notification-laws
Great info! Thank you. :)