DDoSecrets, a WikiLeaks-like repository run by transparency activists, publishes 1TB of data from five companies that was first leaked by ransomware hackers
WikiLeaks successor DDoSecrets has amassed a controversial new collection of corporate secrets and is sharing them in the name of transparency. Tweets: @a_greenberg , @ajohnsocyber , @asher_wolf , @wired , and @campuscodi Tweets: Andy Greenberg / @a_greenberg : WikiLeaks-style transparency group Distributed Denial of Secrets has now started mining a controversial new source of data: the terabytes of information stolen from ransomware victims and dumped online when they refuse to pay. https://www.wired.com/... Ann Johnson / @ajohnsocyber : There is a lock to unpack here in terms of privacy, intellectual property, how the data was obtained, etc. This is a complex issue - and we are ill equipped to address under our current structure of global regs and laws. https://twitter.com/... Asher Wolf / @asher_wolf : “DDoSecrets has made available about 1 terabyte of that data, including more than 750,000 emails, photos, and documents from five companies.” Industries include pharmaceuticals, manufacturing, finance, software, retail, real estate, and oil and gas https://www.wired.com/... @wired : WikiLeaks successor DDoSecrets just posted a terabyte of data that was previously stolen from corporations and leaked by ransomware crews. And they're offering to privately share even more with selected journalists or academic researchers. https://www.wired.com/... Catalin Cimpanu / @campuscodi : Ransomware gangs get a new free CDN provider 🥳 https://twitter.com/...
Context & Ripple Effects
Since it launched its repository with leaked Russian documents in early 2019, DDoSecrets has built its catalog around ideologically driven sources — roughly 270GB of US police department data, the breached Gab archive, and later US government material. What changes here is the supply chain: instead of insider leaks or hacks of its own, the collective is mining the public dump sites ransomware gangs use to pressure non-paying victims.
That matters because it gives stolen corporate data a second distribution path independent of the criminals' own leak infrastructure, and because DDoSecrets is pairing the open release with privately shared additional data for selected journalists and researchers — an access structure it has used before.
First-order effects
- The five victim companies lose any remaining control over their stolen files: data already dumped by ransomware groups is now permanently mirrored on a transparency platform with a journalistic audience.
- Ransomware operators get free amplification — their extortion leverage extends past their own leak sites to a venue that reframes the same material as public-interest disclosure.
Second-order effects
- Victims weighing whether to pay face a worse downside case, since refusal now means the data reaching activists and reporters as well as criminals, which raises effective pressure across every future negotiation.
- Security teams and insurers have to treat public transparency repositories, not just criminal leak sites, as places where breached data surfaces — changing monitoring and notification assumptions after an incident.
Third-order effects
- If this sourcing pattern holds, the line between criminal extortion infrastructure and activist publication blurs structurally: repositories like DDoSecrets become standing secondary markets for breach data, forcing hosts, regulators, and courts to decide whether 'transparency' intent changes liability for redistributing stolen corporate files.
- The tiered model — open dumps for the public, curated feeds for vetted journalists and academics — points toward leak archives institutionalizing as quasi-editorial intermediaries whose sourcing choices, not just their publications, become the contested question.
The trend: Transparency collectives are shifting from soliciting ideological leaks to republishing ransomware dumps, turning criminal extortion infrastructure into a persistent public archive of corporate breaches.