What the new tool does and how it works
Privacy-focused company Proton unveiled a “Data Breach Observatory,” a live reporting hub that monitors credential dumps and dark-web marketplaces to map where personal information is being traded. The project aims to show users and policymakers how stolen data circulates—email-password pairs, phone numbers, and even location traces linked to breached apps. Proton says the Observatory will catalog major leak sources, quantify exposure by platform, and surface trends like password reuse patterns or the resale of the same dataset under different names. For individuals, the value is visibility: understanding which services are repeatedly compromised and whether multifactor authentication was present when credentials leaked. For companies, the dashboard could function as a wake-up call—flagging persistent misconfigurations, weak hashing, or credential-stuffing fallout that customer support teams see anecdotally but rarely measure at scale.

Limits, safeguards, and why this matters now
Proton notes that the Observatory won’t redistribute raw stolen data; instead it will aggregate signals, protect identities, and publish methodology so findings can be audited. Even so, watchdogs will ask tough questions about scraping scope and whether publication incentivizes actors by publicizing marketplaces. Advocates counter that sunlight helps break the impunity cycle and guides regulators on baseline practices—mandatory breach disclosures that include hashing algorithms used, timelines for user notification, and verified counts of affected records. The launch lands as passwordless logins expand and as criminals mix phishing kits with AI-written lure text. A clear view of where credentials are harvested should inform better defaults: universal multi-factor, device-bound passkeys, and vaults that warn users about reused secrets. If Proton sustains a transparent cadence and cooperates with CERTs, the Observatory could become a reference for journalists, insurers, and small businesses deciding when to force resets or rotate keys after upstream partners are compromised.