Drawing on a dozen years of experience running Have I Been Pwned, this talk explores why hackers exfiltrate and share data, what those motives reveal about the evolving threat landscape, and how understanding them helps us respond more effectively in partnership with website operators.