I find my exact name + birthday in the form of FirstnameMiddlenameSurnameDayMonthYear, e.g. JamesWilliamMiller31052000 in the PwnedPasswords List.

But I have a very uncommon Surname (<100 people) and I am absolutely sure nobody has the exact combination of first name, middle name and surname

It gets even weirder because JamesWilliamMiller31052001, JamesWilliamMiller31052002, JamesWilliamMiller31052003, etc... all exist in that list, too. (Which rules out that my parents once have used this as their password)

How come that? Has that Password (I do NOT use this password, I just got curios what I could find in that list) actually ever been leaked?

Edit: My bad I modified the script doing the server request and broke it as I didn't go to check the validity of my programm again. It gave back a count of 1 whenever it should be 0

  • I'm voting to close this question as off-topic because it was a misconfiguration as per updated comment.
    – Rory Alsop
    Mar 16 '19 at 16:34

Very interesting. My guess is that someone was trying to brute-force one of your accounts, so those attempts ended up in their personal cracking dictionaries, which got sold to get incorporated into a bigger list, which got sold ..., and eventually it ended up in the HaveIBeenPwned list.

Not the answer you're looking for? Browse other questions tagged or ask your own question.