Credential Breach Checker — Domain Monitor (HIBP) | $3.9/1K

Credential Breach Checker — Domain Breach Monitor via HIBP

Check which data breaches have affected your company domains using the Have I Been Pwned (HIBP) public API. No API key, no login, no external accounts required.

Use cases

• Security due-diligence: Before partnering or acquiring, check if a target company's domain has appeared in known data breaches.
• Vendor risk assessment: Audit third-party suppliers and SaaS vendors — did their customer data (potentially including yours) get exposed?
• Breach monitoring for company domains: Check your own or competitor domains for any historical incidents. Understand what data classes were exposed.
• Compliance & incident response: Quickly surface known breach history for any domain as part of a security review or audit trail.

What you get per breach record

Field	Description
breach_name	HIBP internal identifier (e.g. Adobe)
title	Human-readable name (e.g. Adobe)
domain	Affected domain
breach_date	Date the breach occurred (YYYY-MM-DD)
pwn_count	Number of accounts exposed
data_classes	List of exposed data types (e.g. ["Email addresses", "Passwords"])
is_verified	Whether HIBP has verified the breach
is_fabricated	Whether the breach is suspected to be fabricated
is_sensitive	Whether the breach is marked sensitive
disclosure_url	Link to official breach disclosure
description	Plain-text breach summary
parse_confidence	high / medium / low

Sample output

{
  "breach_name": "Adobe",
  "title": "Adobe",
  "domain": "adobe.com",
  "source_domain": "adobe.com",
  "breach_date": "2013-10-04",
  "added_date": "2013-12-04T00:00:00Z",
  "pwn_count": 152445165,
  "data_classes": ["Email addresses", "Password hints", "Passwords", "Usernames"],
  "data_class_count": 4,
  "is_verified": true,
  "is_fabricated": false,
  "is_sensitive": false,
  "is_retired": false,
  "is_spam_list": false,
  "is_malware": false,
  "disclosure_url": null,
  "logo_url": "https://haveibeenpwned.com/Content/Images/PwnedLogos/Adobe.png",
  "description": "In October 2013, 153 million Adobe accounts were breached...",
  "parse_confidence": "high",
  "scraped_at": "2026-06-09T10:00:00Z"
}

Input

Field	Type	Description
domains	string[]	Company domains to check (e.g. adobe.com, linkedin.com)
breachNames	string[]	Optional: fetch specific breaches by HIBP name (e.g. Adobe)
verifiedOnly	boolean	Skip unverified/fabricated breaches (default: false)
maxItems	integer	Max total records (default: 100, 0 = no limit)

Free tier vs. keyed tier

This actor uses free unauthenticated HIBP endpoints — no API key needed, zero buyer friction.

The one HIBP capability that requires a paid key ($3.95/mo) is per-email breach lookup (/api/v3/breachedaccount/{email}). This is not implemented here. If you need email-level breach checking, contact us — we can build a keyed premium tier.

Transport

Headless only: curl_cffi with TLS-impersonation (chrome124) + Apify RESIDENTIAL proxy for rate-limit resilience. No browser, no Playwright.

💰 Pricing & how we compare

Pay-per-result (PPE): see pricing card. You are billed per breach-record actually returned — plus the tiny apify-actor-start fee Apify waives for short runs. No subscription, no API key, no proxy fee on top.

Our edge: Have I Been Pwned-based breach exposure · domain & breach-name monitoring · risk view · no key required from you.

How rivals price the same job (live Apify Store, checked 2026-06-09)

Actor	Their price	What they lack vs us
lofomachines/email-breach-checker	$0.05 / email	direct peer — we charm-undercut
s-r/apifyosintemail	$0.005 / result	king, but broad email-OSINT (not breach-focused)
mikolabs/email-checker-verifier	$0.01 / result	email verify, requires your own HIBP key

Prices above are competitors' live Store prices at the time of writing; ours is set to sit just below the strongest comparable while returning richer, quality-scored data.

🤖 Use with AI agents (MCP)

This actor is agent-ready (category MCP_SERVERS). Point any MCP client (Claude Desktop, Cursor, n8n AI, LangGraph) at it:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com/?actors=bovi/credential-breach-checker",
      "headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" }
    }
  }
}

More scrapers from our toolkit

Building a data pipeline? These actors pair well with this one — each runs on your own Apify account with the same pay-per-result pricing, no subscription:

• Coingecko Scraper
• Dexscreener Scraper
• Github Scraper
• Hacker News Scraper

Chain any of them together from the Integrations tab (the Run succeeded trigger) to build a multi-step workflow — one actor's output feeds the next.

Usage statistics

This Actor creates a small, content-free summary at the end of each run. It is used only to monitor reliability and improve this Actor. A copy is saved as USAGE_STATS in your own Apify key-value store, so you can see the exact record created for your run.

Set disableUsageStats to true in the input to opt out. Nothing is sent then; your USAGE_STATS record only says that statistics were disabled.

Only these fields are recorded:

• schema version, Actor name and build number;
• UTC start and finish hour (not a precise timestamp);
• run duration, number of results and time to the first result, each as a coarse range;
• whether the result was empty, the end status, and an error type from a fixed list;
• memory setting and counts of charged events;
• names of the input fields you set, never their values;
• the selected option for input fields that offer a fixed list of choices (for example a sort order).

We do not collect input text, search terms, URLs, domains, usernames, email addresses, names, proxy credentials, tokens, scraped records, output items, raw error messages, stack traces, or hashes of any of those values. Records are kept for no longer than 13 months, used only as aggregated operational statistics, and never sold or shared.

Additional fields (Phase 2)

This Actor also records your Apify user ID, whether Apify marks the account as paying, the size range of list inputs, the selected country when the input offers a fixed list of countries, and one category from a fixed Actor taxonomy. We use these fields only for aggregate reliability, repeat-use and cross-Actor analysis; reports suppress any cell with fewer than five distinct users.

The same disableUsageStats: true input flag turns these fields off too. The user ID is removed after 13 months; we do not export, sell, share, or attempt to re-identify this data.

Run-outcome signals (v2)

To learn whether a run did what it was asked to do, the record also holds a few more coarse ranges and yes/no flags. None of them contains content:

• the result limit you asked for (a range, when the input has one) and what share of it was delivered;
• results delivered per input item you listed (a range);
• output quality as ranges: how fully the result fields were filled, the share of rows that look like errors, the share of duplicate rows, and how many different fields appeared. These are counted in memory while results are saved; no result content is kept;
• how the run was started (console, API, schedule, webhook, another Actor);
• how it ended: stopped by you, timed out, reached the requested limit, stopped by the charge limit, and how many times the platform moved the run;
• if this Actor reports it: how many items to process worked or failed (ranges) and one failure reason from a fixed list;
• a short code made from the names of the input fields you set, never their values.

Repeat-run fingerprint (v2)

When your Apify user ID is recorded (see above), the record also holds an 8-character one-way code made from your input (proxy settings left out) and this Actor's name. It only lets us see that the same account ran the same input again soon after an unsatisfying run; we never see the input itself. It is stored only in the database, never published, and reports use it in aggregate with the same five-user minimum. It is the one exception to the statement above that no hashes are collected, and disableUsageStats: true turns it off.