What is the legality of sharing data from data breaches?

[dngray (Daniel Gray)]

@potg

OSINT person has explained that this leaked data is “public information” so it is legal to have and to create services free or paid to search this data.

Not a lawyer, but I wouldn’t bank on that. What I have noticed is sites like haveibeenpwned for example do not share the corpus data, only a hashed version.

Here are all the reasons I don't make passwords available via Have I been pwned

You can however use a password manager that can do a look up there, and both Bitwarden and KeepassXC have that feature (they create a hash and then check the hash).