"Intelligence agencies and threat actors alike use these and accumulate these lists on the dark web," Lawrence Pingree, a vice president at Dispersive, said, "sometimes repackaged several times, sometimes sold on an individual basis." As Pingree told me, it’s hard to tell without examining the entire dataset, deduplicating the data, and comparing it to standalone breach datasets whether this is a