Distributed Denial of Secrets, abbreviated DDoSecrets, is a nonprofit whistleblower site founded in 2018 for news leaks.[2][3][4] The site is a frequent source for other news outlets and has worked on investigations including Cyprus Confidential with other media organizations.[4][5] In December 2023, the organization said it had published over 100 million files from 59 countries.[6][7][8]
Sometimes called a successor to WikiLeaks,[9][10][11][12][13][14] it came to international attention for its June 2020 publication of internal US police documents, known as BlueLeaks. The group has also published data on Russian oligarchs, fascist groups, shell companies, tax havens and banking in the Cayman Islands, as well as data scraped from Parler in January 2021 and from the February 2021 Gab leak. The group is also known for publishing emails from military officials, City Hall in Chicago and the Washington D.C. Metropolitan Police Department.
The site's leaks have resulted in or contributed to multiple government investigations, including the second impeachment of President Donald Trump.[15][16] During the Russo-Ukrainian War, it was considered one of the best public repositories of all the Russian files leaked since the invasion began.[17][18]
Distributed Denial of Secrets was founded by Emma Best, an American national security reporter known for filing prolific freedom of information requests, and Thomas White, an administrator of the Silk Road 2.0.[4][19][20] At its public launch in December 2018, the site held more than a terabyte of data from many of the highest-profile leaks. The site originally considered making all of the data public, but after feedback made some of it available only to journalists and researchers.[21]
Best has served as a public face of the group, which lists its members.[22] In February 2019, they told Columbia Journalism Review that fewer than 20 people worked on the project. According to Best, several early members of the project were driven to radical transparency work by their past background with the state, which they compared to Chelsea Manning and other whistleblowers. Best said, "Those associations all ended well prior to DDoSecrets coming together and were internally disclosed early on."[4] In April 2021, the website listed 10 members and advisors.[22]
In December 2019, Distributed Denial of Secrets announced its collaboration with the Organized Crime and Corruption Reporting Project.[23] In May 2020, DDoSecrets partnered with European Investigative Collaborations and the Henri-Nannen-Journalistenschule journalism school.
In December 2020, the group announced its affiliation with Harvard University's Institute for Quantitative Social Science.[24]
In January 2024, DDoSecrets launched the Greenhouse Project to preserve censored information and create a "warming effect to reverse the chilling effects of censorship" as part of its broader mission to ensure the free transmission of data in the public interest by making itself a "publisher of last resort".[8] In June 2024, DDoSecrets' revamped their website[25] and in July, DDoSecrets launched two new projects, the Library of Leaks and Disclosure Without Borders. The Library of Leaks focuses on preserving existing data and coordinating with outside groups and Disclosure Without Borders focuses on new publications and source protections.[25]
In January 2026, DDoSecrets announced that their website address had changed to a .org top-level domain. The change happened because their original .com domain was not automatically renewed due to incorrect contact information with the domain registrar. DDoSecrets advised users to update any .com links to the new .org address, as the old domain was no longer under their control and is illegitimate.[26]
DDoSecrets and the people behind the project have been described by Wired as a "transparency collective of data activists"[10] and a successor to WikiLeaks,[27][28] by the Congressional Research Service, Organized Crime and Corruption Reporting Project, Human Rights Watch and The Nation as a "transparency collective",[29][30][31] by The Hill as a "leaktivist collective",[32] by Columbia Journalism Review as a "journalist collective", by Brookings Institution as "a WikiLeaks-style journalist collective,"[33] by the New York Times as a "watchdog group",[34] and Business Insider as a "freedom-of-information advocacy group",[35] as an "alternative to WikiLeaks" by Columbia Journalism Review,[36] Krebs On Security,[37] ZDNet,[38] and Forbes,[39] and as "the most influential leaking organization on the internet" by VICE News."[40]
In 2019, the Congressional Research Service recognized Distributed Denial of Secrets as a transparency collective.[29] In December 2019, politicians in Sweden and the UK, including anti-corruption chief John Penrose said that leaks published by Distributed Denial of Secrets showed the need for reforms on company creation and registration.[41][42] That month, Belgian tax authorities initiated an investigation based on data published by DDoSecrets the prior month.[43]
In 2020, the U.S. counterintelligence strategy described leaktivists and public disclosure organizations like Distributed Denial of Secrets as "significant threats," alongside five countries, three terrorist groups, and "transnational criminal organizations."[11][44]
As of, the site hosts dozens of terabytes of data from over 200 organizations.[64][65] In December 2023, the organization said it had published over 100 million files from 59 countries.[6][7][8] The group has said it uses "a mixed distribution model, publishing information both to the general public and restricting some information to journalists and researchers when there's a lot of sensitive information."[8]
In December 2018, DDoSecrets listed a leak from Russia's Ministry of Internal Affairs,[66] portions of which detailed the deployment of Russian troops to Ukraine at a time when the Kremlin was denying a military presence there. About half of the material from that leak was published in 2014; the other half emerged in 2016.[67] WikiLeaks reportedly rejected a request to host the full cache of files in 2016.[67]
In January 2019, DDoSecrets published hundreds of gigabytes of hacked Russian documents and emails from pro-Kremlin journalists, oligarchs, and militias.[68]
In November 2019, DDoSecrets published over 2 terabytes of data from the Cayman National Bank and Trust. The files were provided by the hacktivist known as Phineas Fisher, and included lists of the bank's politically exposed clients. The leak was used by researchers to study how elites use offshore banking.[69][70][71]
In December 2019, DDoSecrets published "#29 Leaks" in partnership with the Organized Crime and Corruption Reporting Project and more than 20 outlets in 18 countries.[72] The 450 gigabytes of data came from Formations House
In 2020, DDoSecrets published a copy of the Bahamas corporate registry. DDoSecrets partnered with European Investigative Collaborations and the German Henri-Nannen-Schule journalism school to create the Tax Evader Radar, a project to review the dataset of almost one million documents.[78] The project exposed the offshore holdings of prominent Germans,[79] the tax activities of ExxonMobil,[80] as well as offshore business entities belonging to the DeVos and Prince families.[81]
In March 2020, DDoSecrets published 156 gigabytes of data hacked from the Myanmar Investment Commission.[82]
In January 2021, DDoSecrets made videos scraped from Parler available to journalists.[90] Some of these videos were later used as evidence during the second impeachment trial of Donald Trump.[91]
In February 2021, DDoSecrets gave journalists access to hundreds of thousands of financial documents from the Myanmar Directorate of Investment and Company Administration (DICA).[92] Justice For Myanmar called the release "biggest leak in Myanmar history."[93]
On February 28, DDoSecrets revealed "GabLeaks", a collection of more than 70 gigabytes of data from Gab, including more than 40 million posts, passwords, private messages, and other leaked information. The group said that they would not release the data publicly because it contained a large amount of private and sensitive information, and instead shared the data with select journalists,
In February 2022, after many anonymous donors supported the 2022 Freedom Convoy, DDoSecrets began providing journalists and researchers with a hacked list of donors' personal information from GiveSendGo. Later that month, GiveSendGo was hacked again, exposing donors for every campaign in the site's history, which DDoSecrets gave to journalists and researchers.[110]
In May 2022, DDoSecrets published 128,700 emails allegedly associated with a Hunter Biden laptop that were being circulated by allies of and former staff of President Donald Trump. DDoSecrets said it published the emails "to counteract possible deceptions by persons with an agenda who are currently distributing the dataset without the relevant context or warnings," because there were "considerable issues with this dataset including signs of tampering" and "more than one altered or implanted emails".[111] DDoSecrets also made a copy of the alleged laptop available to journalists and researchers.[18]
During the Russo-Ukrainian War, DDoSecrets published more than 40 datasets of Russian leaks, totaling at least 5.8 terabytes.[65]
In January 2023, DDoSecrets published files from ODIN Intelligence, a contractor for law enforcement and police departments.[118][119][120] They also published files from the Cyprus-based corporate service provider MeritServus.[121]
In February 2023, DDoSecrets published documents from the 2022–2023 Pentagon document leak,[122][123] and tax records from Myanmar
In 2024, DDoSecrets launched the "Greenhouse Project" to preserve censored information and create a "warming effect to reverse the chilling effects of censorship" as part of its broader mission to ensure the free transmission of data in the public interest by making itself a "publisher of last resort". The first entry in the project was a November 16, 2023 Reuters story that alleged that a hacking-for-hire firm called Appin had stolen secrets from executives, politicians, military officials, and wealthy elites around the globe and supporting documents. The story was removed by Reuters following an order from a district court in New Delhi, India.[8]
At the Hackers On Planet Earth (HOPE) conference in June, DDoSecrets announced that the next entry in the Greenhouse Project was mirroring all of WikiLeaks' data after datasets became unavailable to download from the site and Julian Assange's plea deal required the organization to remove information. Emma Best said that the goal was making the WikiLeaks data more accessible and resilient against additional censorship and future website failures. Some of the data were things that DDoSecrets said they "would have handled that data differently than WikiLeaks did, the data is out there and we shouldn't act as censors for it".[25]
In July 2024, DDoSecrets published dossiers on
In May 2025, DDoSecrets released a cache of data from TeleMessage, an Israeli messaging software. The TeleMessage leaks included correspondence from over 60 different government officials, including disaster responders, customs officials, American diplomatic staff, at least one White House staffer, and members of the United States Secret Service.[148]
In August, DDoSecrets released a collection of emails and attachments from the former Israeli prime minister Ehud Barak, from dates spanning 2013 to 2016. These emails notably included correspondence between Jeffrey Epstein and Barak.[149][150][151]
Later that year, DDoSecrets released the Boris Files, a collection of leaked data relating to the British Prime Minister Boris Johnson.[152]
In 2021, legislators in Maine introduced a bill to close the state's fusion center in response to BlueLeaks and whistleblower reports.[50]
In 2022, law enforcement agencies in New York, New Jersey, Washington and Oregon launched investigations into officers who appeared in the leaked Oath Keepers records published by DDoSecrets.[51]
In November 2023, governments including Cyprus president Nikos Christodoulides and European lawmakers began responding to the Cyprus Confidential findings in less than 24 hours after it was released,[52] calling for a crackdown on financial corruption[53] and launching criminal probes into allegations of money laundering.[54][52][55] According to Emma Best, the Department of Defense asked DDoSecrets to remove the 2022–2023 Pentagon document leaks, but DDoSecrets "basically just ignored them".[8]
In June 2020, the organization was banned from Twitter[56][57] in response to BlueLeaks, citing a breach of their policies against "distribution of hacked material"[58] in a move that was criticized as setting a "dangerous precedent."[59] In September 2023, The Intercept reported that access to the organization's website was blocked by Indonesia and Russia and censored by Twitter and Reddit.[60][8] In 2024, they refused a take down letter from Brainstack over data from their spyware company, mSpy.[61] A Telegram channel operated by the group was closed without notice after publishing data from Israel's Ministry of Justice.[61][62]
DDoSecrets published about one million emails from the Mineral Resources Authority (MRA) of Papua New Guinea in February 2025, leading to attempts of censorship. Hamilton Vagi, head of the National Cyber Security Centre of Papua New Guinea, sent a threatening letter to DDoSecrets demanding immediate removal of the material. The attempt ultimately drew more attention to the MRA emails, invoking the Streisand effect.[63]
In December 2019, DDoSecrets published "PacoLeaks" and "MilicoLeaks": data from Chilean military police and military. PacoLeaks revealed police personnel data, extensive police files on activist groups and leaders, and evidence that the police had infiltrated activist groups[75] MilicoLeaks included details on Chilean army intelligence, including operations, finance and international relations.[76][77]
In April 2020, DDoSecrets published almost 10million messages from more than 100 Discord servers used by neo-Nazi and QAnon conspiracy theorist groups.[85] The leaked chats showed threats of violence and attempts to influence the 2018 United States midterm elections.[86]
On June 19, 2020, DDoSecrets released BlueLeaks, which consisted of 269 gigabytes of internal U.S. law enforcement data obtained from fusion centers by the hacker collective Anonymous. DDoSecrets called it the "largest published hack of American law enforcement agencies."[87] Betsy Reed described BlueLeaks as the U.S. law enforcement equivalent to the Pentagon Papers.[88]
In July 2020, DDoSecrets released documents relating to the United States' case against WikiLeaks founder Julian Assange. The release also included chat logs and letters between Assange and various sources.[89]
In April 2021, Distributed Denial of Secrets made donor information from the Christian crowdfunding site GiveSendGo available to journalists and researchers. The information identified previously anonymous high-dollar donors to far-right actors including members of the Proud Boys, many of whose fundraising efforts were directly related to the 2021 United States Capitol attack.[95]
Also in April 2021, DDoSecrets published a cache of emails from Chicago City Hall.[96][97] The emails revealed that the city's handling of fatal shootings by police officers violates state law and a federal consent decree.[98] The emails also exposed the Mayor's secret lobbying for qualified immunity,[99] a secret drone program funded with off-the-books cash,[100] and the city's problems with police chases and the George Floyd protests.[101][102]
In May 2021, DDoSecrets republished the leak of Washington D.C.'s Metropolitan Police Department, including over 90,000 emails. Among other things, the files revealed details of surveillance of right-wing extremists and the response to the 2021 United States Capitol attack.[103][104]
In September 2021, DDoSecrets publicly released emails and chat logs from the American far-right Oath Keepers organization to the public. They also provided member and donor data to the press. This exposed hundreds of members in law enforcement, over a hundred members with ties to the military and dozens in political office.[105][106][107]
In November 2021, DDoSecrets released 1.8 terabytes of police helicopter surveillance footage from the Dallas Police Department and the Georgia State Patrol.[108][109]
In September, they published Fuerzas Represivas, a collection of military documents from Latin America and Mexico totaling more than 13 terabytes, which Emma Best called "the largest leak in history". The leak included the Chilean Joint Chiefs of Staff, the Mexican Ministry of National Defense and the Joint Command of the Armed Forces of Peru.[115]
In November, they published documents from Innwa Bank in Myanmar[116] and republished files from Liberty Counsel.[117]
In August 2023, DDoSecrets published over 500,000 documents and other files from the National Police of Paraguay.[126] In October, they published intelligence documents about investigations involving former president of Paraguay Horacio Cartes.[127] They also published emails and documents from Ethiopia's Financial Intelligence Service.[128][129]
In November 2023, the Organized Crime and Corruption Reporting Project joined with more than 40 media partners including Cerosetenta / 070,[130] Vorágine,[131] the Centro Latinoamericano de Investigación Periodística (CLIP)[132] and Distributed Denial of Secrets and journalists in 23 countries and territories for the largest investigative project on organized crime to originate in Latin America, producing the 'NarcoFiles' report. The investigation was based on more than seven million emails from the Colombian prosecutor's office which had been hacked by Guacamaya, including correspondence with embassies and authorities around the world. The files dated from 2001-2022 and included audio clips, PDFs, spreadsheets, and calendars.[133][134] The investigation revealed new details about the global drug trade and over 44 tons of "controlled deliveries" carried out to infiltrate the drug trade[135][136] and how criminals corrupt politicians, bankers, accountants, lawyers, law enforcement agents, hackers, logistics experts, and journalists in order to use logistical, financial, and digital infrastructures.[137]
Also in November 2023, the International Consortium of Investigative Journalists, Paper trail media and 69 media partners including Distributed Denial of Secrets and the OCCRP and more than 270 journalists in 55 countries and territories[138][139] produced the 'Cyprus Confidential' report on the financial network which supports the regime of Vladimir Putin, mostly with connections to Cyprus, and showed Cyprus to have strong links with high-up figures in the Kremlin, some of whom have been sanctioned.[140][141] Government officials including Cyprus president Nikos Christodoulides[53] and European lawmakers[53] began responding to the investigation's findings in less than 24 hours,[52] calling for reforms[53] and launching probes.[54][52][55]
The controversial social media personality Andrew Tate's online university known as The Real World was hit with a cyberattack by anonymous hackers in November 2025. Following this, DDoSecrets released the entirety of the compromised data comprising almost 800,000 usernames, more than 300,000 email addresses, and correspondence taken from the platform's hundreds of public and private chat servers.[147]
