In security, there's often no choice but to rely on leaked data. There is generally no other source of things like password hashes reflecting real-world user passwords.

So the question then becomes "Is it ethically appropriate to perform security research that requires realistic data at all?". With the caveat that blackhats can and will do research and use the results privately no matter what the rest of us do.

What do you think?

While I won't be downloading the data to my own server, I have no issue with others analysing it nor with reading analyses by those folks. Especially ones like this one, which is essentially anonymous.

As long as the action stops at analysis, and doesn't provide tools for others to easily go further, then that seems fine to me.

IMHO, the ethics are similar to the use of data obtained by German/Japanese scientists during WWII: the violation is on the persons who directly acquire the information; but, once obtained, those who receive it indirectly aren't ethically liable.