Is it ethical to make use of a public dump of hacked data?

That probably depends on what you are doing with it, and how the results can be used. Note "can be" and not "expected to be."

For example, haveibeenpwned uses "hacked data dumps" for their service, and uses it in an ethical way. Of course you don't enter your password - just the associated account user name, to see if it shows up in the database. I don't know however, if they have a way to tell if the password has been changed, thus killing any possibility of telling if the account has been pwned more than once.

The Credit Card Cop site used to as well. But in their case, I always questioned the ethics of teaching people it's okay to enter their full credit card numbers to a site they've otherwise not done business with, to see if they've already been collected once... how does the user know they didn't just fall for a scam to collect their credit card numbers?

I met the owner (Dan something) at an infosec tradeshow once. I think his heart was in the right place, but he thought I was overthinking my concerns, and my idea of at least using hashes of the stolen card numbers, compared to hashed input was overkill. I'm pretty sure that database was illegal, and if there was ever an intrusion, no insurance company in the world would cover his liability on that one.

The service doesn't exist anymore, and their site is ironically now owned by what definitely looks like a credit scam. The site content (complete with typo in the name) has Lorem Ipsum text throughout, something about buying humorous Lorem Ipsum, etc. And confusingly, some text about a fake Photoshop plugin called Focus. It's literally the most baffling fake site I've ever seen.

Further, there are legal implications, given GDRP and similar rules. I personally wouldn't do what you're suggesting, but maybe if you spoke to a business lawyer you'll head off in a wholly appropriate direction with a clear benefit to those whose data you are using.

Thanks to the folks who commented. They were all pretty strongly in the camp that it is unethical, and I'm inclined to agree with their arguments.

It's likely unethical by most people's standards and illegal in many countries

> I don't personally mind, since my attitude is that so many people are already doing this

There's a common idiom about people jumping off of bridges that applies equally well to committing crime or being unethical

Do you want to be an unethical person or break the law?

No, it's not ethical in any framework I am aware of to knowingly benefit from the fruits of theft.

That said, ethics isn't boolean, and it's not as if you're murdering children by making use of this data...

Use the golden rule: would you mind if somebody did that to you, one of your relatives, friends, son, daughter?