Freedom Hosting II Breach and Email Check

A public breach source catalogues the Freedom Hosting II incident for fhostingesps6bly.onion with a breach date of 31 January 2017 and marks the record verified and sensitive. XposedOrNot matches the same onion domain and the email, username, and password classes in a verified incident. Contemporaneous reporting by The Verge on 3 February 2017 describes the claimed compromise of the hosting servers and a researcher-compiled list of 10,613 hosted addresses. These sources corroborate the event; they do not prove that 31 January was the initial-access date or that every hosted site was affected in the same way.

A public breach source’s 380,830 value is an external catalogue account/dataset count, not a distinct-person count or the number of emails in LeakData. LeakData’s historical email-only import contained 253,909 live relations. After a rollback backup was sealed, 194 relations that do not satisfy the current canonical-ascii-email-v1 rule were removed. Local search now contains 253,715 unique, current-policy email relations. The 127,115 difference from the external catalogue cannot be interpreted as missing people, proven rejected rows, or the complete remainder of the incident.

The registered 240,482,323-byte archive was not fully available in this review, and the historical import file, manifest, and source hash were not preserved. A 253,909-line, 5,853,597-byte reconstruction of the live import matches the historical job counters, but byte identity with the source and completeness for the incident cannot be proven. A public breach source describes MySQL data from thousands of heterogeneous hosted services and states that actual fields differ among sites. Email, username, and password classes therefore must not be treated as co-occurring in every row. Only email relations were imported into LeakData; usernames and passwords were not imported.

A positive result shows only that the queried email occurs in the reviewed local subset. It does not establish that a person operated or administered Freedom Hosting II, was its customer, used a particular hidden service, owned any content, or was associated with that content. A negative result does not cover all 380,830 catalogue records or the entire incident. If a source-authenticated password is known to have been reused elsewhere, replace it everywhere it was reused. A threat or message quoting a real identifier does not authenticate its sender or claims; verify it through an independent official channel.