When hackers become sources: Inside the new craft of reporting on hacked data

Some consequential reporting of recent years has emerged thanks to what is normally defined as a “hack-and-leak,” a specific kind of cyberattack that results in the release of the information obtained by hackers. When Anonymous and allied collectives breached corporations and state agencies during the hacktivist wave of the 2010s, for instance, they turned stolen data into front-page news.

Reporters covering the invasion of Ukraine have frequently worked with documents pulled from Russian institutions by hackers of different allegiances. Hacktivists have breached surveillance vendors and spyware firms, granting journalists direct and exclusive access to the internal files of companies that sell to repressive governments. Ransomware gangs, cybercriminal groups, and state-affiliated hackers deposit fresh troves of hacked data on the open internet, or route it to the public through intermediaries like Distributed Denial of Secrets.

How are journalists responding to these reporting scenarios? For my research, recently published in Journalism Practice, I interviewed 10 journalists across the U.S. and Europe who work or have worked with hacked data. Some of them specialize in the coverage of cyber issues; others mainly focus on current affairs and global conflict. These journalists work for a variety of news outlets, from investigative reporting newsrooms to general interest outlets and technology brands, and have engaged with hacker sources at various levels.

The journalists I spoke with paint a picture of an emerging craft, rather than a settled method. Here’s some of what I found.

There are no fixed guidelines or established and shared practices on how to handle and report on hacked material in news reporting. Instead, the methods are being developed by practitioners on a case by case basis. One reporter who works for an investigative newsroom told me:

On one hand, you have the traditional investigative journalists digging through large datasets from major leaks, who approach the material with the classic reporting toolkit, corroboration, interviews, contextualizing the data…On the other hand, there’s this newer, more technical niche where people work with constantly emerging, often smaller-scale data exposures, like scraping dark web dumps, pastebins, or unsecured cloud buckets, and turning those into fast-paced stories about breaches, vulnerabilities, and digital privacy. It’s less about deep-dive investigation and more about monitoring and exposing ongoing data exposures in real time.

Hackers themselves are becoming increasingly strategic about their relationships with the press. One reporter following a specific cyber beat emphasized this:

“I’d say that [hackers] of all kinds love to flex and get credit. A lot of them don’t, but many absolutely do. I’m not sure if the desire to flex has increased, but you’ve definitely seen the maturity of some hackers in how they approach the media. It’s not just about posting things to Twitter like it might have been before.

That maturity means developing awareness of how a story will be framed and disseminated and calculating which journalist to approach. Hackers now may select their outlets of choice, matching a leak to the reporter who they think is capable of understanding the story and carrying it further.

There are different kinds of hackers, wearing different and/or multiple hats. Interviewees drew distinctions between financially motivated cybercriminals, whose leaks are often equivalent to extortion by other means, and state-affiliated actors, who may also pose as independent hacktivists to launder politically motivated leaks into credible coverage.

At the same time, some hackers or hacker collectives — like Phineas Fisher, known for his activist remit against surveillance companies — may act for political and public interest–oriented reasons, reaching out to journalists to expose wrongdoing, unethical issues, or crimes. Notoriously, though, hacking is not a field in which hats are worn straightforwardly: Identities, definitions and agendas, including mere trolling, may blur into one another.

Hacked material needs to be handled with a great deal of skepticism. When working with hacked sources, one journalist said, it’s a matter of “treating every dataset as if it has chlamydia.” But the verification techniques the journalists said they use — such as confirming that an email address exists in a company’s records, cross-referencing with known facts, or examining a file for signs of tampering — are fairly conventional. This type of reporting requires more disclosures, especially when a source’s identity can’t be established. One journalist working in this area said:

I think you should be very transparent about that in your reporting. You should say something like, “We don’t know who the source is; it could be the GRU [Russian Federation] or whoever, but we have confirmed that this data is real and this is what it shows.”

Declared openly, the uncertainty may become a meaningful part of the story itself.

Source protection is further complicated when it comes to hackers. Some interviewees extend the full protection they would give any source to hackers, refusing to assist law enforcement even if the source is a self-declared criminal. Others prefer to know as little as possible about their sources, framing the choice as harm reduction for both parties. As one journalist in my sample put it:

The less I know about these things, the harder it’s going to be for me to burn my source or to publish something that inadvertently turns out to be harmful to my source.

Reporters working exclusively with material already circulating online in cybercrime forums or other repositories on the web treat source protection as beside the point, because the origins of the information cannot be traced and because the material is in effect “out there.”

Beneath all of this sits the finding with the widest implications: Ethical decisions in this domain resist strict codification. No general rule can be written in advance, the reporters I spoke with suggested, and judgment in the individual case is the only workable guide. Is publishing hacked material justified? It depends on the specifics of the case at hand, one reporter told me.

I kind of think it all depends on what you’re exposing. Maybe it’s generally wrong to break into people’s computers and steal data, but if you’re exposing serious crimes, then I think it can be justified.

Interviewees described practical wisdom under pressure: the ability to read a specific situation and act appropriately n it, without having the opportunity to refer to an established code or checklist.

Newsrooms, meanwhile, may need to develop verification standards suited to information of illicit origin, transparency norms that treat uncertainty as something to disclose rather than paper over, and a shared language for the ethical judgments that journalists currently make case by case on their own.