> The only thing to do is release it so people know if they've been exposed. Are we talking about a Troy Hunt-style (haveibeenpwned) website? If so, I don't co

> The only thing to do is release it so people know if they've been exposed. Are we talking about a Troy Hunt-style (haveibeenpwned) website? If so, I don't consider a giant hashset-of-hashes a "release" because if that data (haveibeenpwnd's database) gets leaked it's of zero use to anyone because it doesn't contain any original data anymore. But if you mean Wikileaks-style: put it all in a .rar file and publicise it, maintaining that the-ends-justify-the-means approach despite all the irresponsible-journalism, then absolutely no. Yikes. No.