# Credential Breach Checker — Domain Monitor (HIBP) | $3.9/1K (`bovi/credential-breach-checker`) Actor Check data breaches for company domains via Have I Been Pwned. Get breach date, pwned count, data classes, verification status. No API key required. - **URL**: https://apify.com/bovi/credential-breach-checker.md - **Developed by:** [Vitalii Bondarev](https://apify.com/bovi) (community) - **Categories:** Developer tools, Business, MCP servers - **Stats:** 1 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $3.78 / 1,000 breach records This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ### Credential Breach Checker — Domain Breach Monitor via HIBP Check which data breaches have affected your company domains using the [Have I Been Pwned](https://haveibeenpwned.com/) (HIBP) public API. No API key, no login, no external accounts required. ### Use cases - **Security due-diligence**: Before partnering or acquiring, check if a target company's domain has appeared in known data breaches. - **Vendor risk assessment**: Audit third-party suppliers and SaaS vendors — did their customer data (potentially including yours) get exposed? - **Breach monitoring for company domains**: Check your own or competitor domains for any historical incidents. Understand what data classes were exposed. - **Compliance & incident response**: Quickly surface known breach history for any domain as part of a security review or audit trail. ### What you get per breach record | Field | Description | |---|---| | `breach_name` | HIBP internal identifier (e.g. `Adobe`) | | `title` | Human-readable name (e.g. `Adobe`) | | `domain` | Affected domain | | `breach_date` | Date the breach occurred (`YYYY-MM-DD`) | | `pwn_count` | Number of accounts exposed | | `data_classes` | List of exposed data types (e.g. `["Email addresses", "Passwords"]`) | | `is_verified` | Whether HIBP has verified the breach | | `is_fabricated` | Whether the breach is suspected to be fabricated | | `is_sensitive` | Whether the breach is marked sensitive | | `disclosure_url` | Link to official breach disclosure | | `description` | Plain-text breach summary | | `parse_confidence` | `high` / `medium` / `low` | ### Sample output ```json { "breach_name": "Adobe", "title": "Adobe", "domain": "adobe.com", "source_domain": "adobe.com", "breach_date": "2013-10-04", "added_date": "2013-12-04T00:00:00Z", "pwn_count": 152445165, "data_classes": ["Email addresses", "Password hints", "Passwords", "Usernames"], "data_class_count": 4, "is_verified": true, "is_fabricated": false, "is_sensitive": false, "is_retired": false, "is_spam_list": false, "is_malware": false, "disclosure_url": null, "logo_url": "https://haveibeenpwned.com/Content/Images/PwnedLogos/Adobe.png", "description": "In October 2013, 153 million Adobe accounts were breached...", "parse_confidence": "high", "scraped_at": "2026-06-09T10:00:00Z" } ```` ### Input | Field | Type | Description | |---|---|---| | `domains` | `string[]` | Company domains to check (e.g. `adobe.com`, `linkedin.com`) | | `breachNames` | `string[]` | Optional: fetch specific breaches by HIBP name (e.g. `Adobe`) | | `verifiedOnly` | `boolean` | Skip unverified/fabricated breaches (default: `false`) | | `maxItems` | `integer` | Max total records (default: `100`, `0` = no limit) | ### Free tier vs. keyed tier This actor uses **free unauthenticated HIBP endpoints** — no API key needed, zero buyer friction. The one HIBP capability that requires a paid key ($3.95/mo) is **per-email breach lookup** (`/api/v3/breachedaccount/{email}`). This is not implemented here. If you need email-level breach checking, contact us — we can build a keyed premium tier. ### Transport Headless only: `curl_cffi` with TLS-impersonation (`chrome124`) + Apify RESIDENTIAL proxy for rate-limit resilience. No browser, no Playwright. ### 💰 Pricing & how we compare **Pay-per-result (PPE): see pricing card.** You are billed per `breach-record` actually returned — plus the tiny `apify-actor-start` fee Apify waives for short runs. No subscription, no API key, no proxy fee on top. **Our edge:** Have I Been Pwned-based breach exposure · domain & breach-name monitoring · risk view · no key required from you. #### How rivals price the same job (live Apify Store, checked 2026-06-09) | Actor | Their price | What they lack vs us | |---|---|---| | `lofomachines/email-breach-checker` | $0.05 / email | direct peer — we charm-undercut | | `s-r/apifyosintemail` | $0.005 / result | king, but broad email-OSINT (not breach-focused) | | `mikolabs/email-checker-verifier` | $0.01 / result | email verify, requires your own HIBP key | *Prices above are competitors' live Store prices at the time of writing; ours is set to sit just below the strongest comparable while returning richer, quality-scored data.* ### 🤖 Use with AI agents (MCP) This actor is agent-ready (category **MCP\_SERVERS**). Point any MCP client (Claude Desktop, Cursor, n8n AI, LangGraph) at it: ```json { "mcpServers": { "apify": { "url": "https://mcp.apify.com/?actors=bovi/credential-breach-checker", "headers": { "Authorization": "Bearer " } } } } ``` # Actor input Schema ## `domains` (type: `array`): Company domains to look up in the HIBP breach catalog. Examples: adobe.com, linkedin.com, canva.com. Each domain returns all known breaches linked to it. ## `breachNames` (type: `array`): Fetch specific named breaches by their HIBP identifier (e.g. Adobe, LinkedIn, Canva). Use this to enrich or verify specific incidents. Leave empty to only use the domains input. ## `verifiedOnly` (type: `boolean`): When true, skip unverified (fabricated/unconfirmed) breaches. Default: false — return all breaches including unverified ones. ## `maxItems` (type: `integer`): Maximum total breach records to return across all domains. 0 = no limit. Default: 100. ## `proxyConfiguration` (type: `object`): Apify proxy to use if HIBP rate-limits direct requests. Default: Apify RESIDENTIAL. ## Actor input object example ```json { "domains": [ "adobe.com", "linkedin.com" ], "breachNames": [], "maxItems": 100, "proxyConfiguration": { "useApifyProxy": true, "apifyProxyGroups": [ "RESIDENTIAL" ] } } ``` # Actor output Schema ## `results` (type: `string`): Dataset containing Credential Breach Checker records (breach\_name, title, domain, breach\_date, pwn\_count, data\_classes, is\_verified, is\_sensitive, is\_fabricated, added\_date, description, parse\_confidence, scraped\_at). # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "adobe.com", "linkedin.com" ], "breachNames": [], "verifiedOnly": false, "maxItems": 100, "proxyConfiguration": { "useApifyProxy": true, "apifyProxyGroups": [ "RESIDENTIAL" ] } }; // Run the Actor and wait for it to finish const run = await client.actor("bovi/credential-breach-checker").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": [ "adobe.com", "linkedin.com", ], "breachNames": [], "verifiedOnly": False, "maxItems": 100, "proxyConfiguration": { "useApifyProxy": True, "apifyProxyGroups": ["RESIDENTIAL"], }, } # Run the Actor and wait for it to finish run = client.actor("bovi/credential-breach-checker").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "adobe.com", "linkedin.com" ], "breachNames": [], "verifiedOnly": false, "maxItems": 100, "proxyConfiguration": { "useApifyProxy": true, "apifyProxyGroups": [ "RESIDENTIAL" ] } }' | apify call bovi/credential-breach-checker --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=bovi/credential-breach-checker", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Credential Breach Checker — Domain Monitor (HIBP) | $3.9/1K", "description": "Check data breaches for company domains via Have I Been Pwned. Get breach date, pwned count, data classes, verification status. No API key required.", "version": "0.1", "x-build-id": "bN44HitcZDDqSWCyb" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/bovi~credential-breach-checker/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-bovi-credential-breach-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/bovi~credential-breach-checker/runs": { "post": { "operationId": "runs-sync-bovi-credential-breach-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/bovi~credential-breach-checker/run-sync": { "post": { "operationId": "run-sync-bovi-credential-breach-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "domains": { "title": "Domains to check", "type": "array", "description": "Company domains to look up in the HIBP breach catalog. Examples: adobe.com, linkedin.com, canva.com. Each domain returns all known breaches linked to it.", "items": { "type": "string" } }, "breachNames": { "title": "Specific breach names (optional)", "type": "array", "description": "Fetch specific named breaches by their HIBP identifier (e.g. Adobe, LinkedIn, Canva). Use this to enrich or verify specific incidents. Leave empty to only use the domains input.", "items": { "type": "string" } }, "verifiedOnly": { "title": "Verified breaches only", "type": "boolean", "description": "When true, skip unverified (fabricated/unconfirmed) breaches. Default: false — return all breaches including unverified ones." }, "maxItems": { "title": "Max items total", "minimum": 0, "type": "integer", "description": "Maximum total breach records to return across all domains. 0 = no limit. Default: 100." }, "proxyConfiguration": { "title": "Proxy configuration", "type": "object", "description": "Apify proxy to use if HIBP rate-limits direct requests. Default: Apify RESIDENTIAL." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```