However, the hacker behind the phishing attack appears to have only stolen the email addresses of those who subscribed to Troy Hunt's blog, rather than Haveibeenpwned.com.