Newsletter
Krebs on Security
Brian Krebs
Original long-form investigations into cybercrime, breaches, data brokers, and scams, several times a month, delivered by email or RSS. Not an OSINT letter, but every article is an OSINT case study.
Brian Krebs reported for the Washington Post before founding the blog in 2009. Articles run one to three thousand words, built on sources, documents, and open-source attribution of criminals. It is free, ad-supported, and the writing investigators quote most when explaining what attribution looks like.
Worth it if
- You want to see attribution done in public, with the evidence shown
- You investigate fraud, ransomware, or data brokers
- You want readable security writing for a general audience
Skip it if
- You want technique instructions; the method is shown, not taught
- You need a digest; this is one story at a time
What is inside
- 01
Investigations
Cybercrime, ransomware, breaches, scams, and the people behind them, often identified through open sources.
- 02
Patch Tuesday
Monthly summaries of major vendor patches.
- 03
Data brokers and privacy
Recurring reporting on people-search sites and what they expose.
What you will be able to do
- Read an attribution and reconstruct the open-source steps behind it
- Recognise the fraud and cybercrime patterns investigators meet
- Explain to non-specialists why a breach matters
How current it is
Active, with posts on 7 and 9 October 2026.
- Updated
- Latest post 9 October 2026
- Maintained
- Actively maintained
How to get the most from it
- 01
Reverse-engineer one article
List every source cited and ask how you would have found it. It is a free OSINT exercise.
- 02
Follow the data broker stories
They double as a guide to removing yourself from people-search sites.
Strengths
- Original reporting
- Attribution shown with evidence
- Free archive since 2009
Limitations
- Not a how-to
- Irregular
- US-centric
Pair it with
FAQ
Questions, answered
Is this OSINT?
The articles are built with it. The newsletter does not teach it, which is why it is listed with that caveat.
How do I subscribe?
An email field on the subscribe page, or the RSS feed.
Learned the method? Practise it on real data
The resources above teach the craft. When you want to run real lookups across breach, people, domain, and crypto sources without opening a dozen vendor accounts, that is what SearchIn is for.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days