# Domain & Email Breach Checker — Have I Been Pwned (`gochujang/domain-breach-checker`) Actor

Check if domains or emails appear in known data breaches. Uses Have I Been Pwned database. Returns breach names, dates, data types exposed (passwords, emails, phone numbers). Monitor for new breaches affecting your organization.

- **URL**: https://apify.com/gochujang/domain-breach-checker.md
- **Developed by:** [Hojun Lee](https://apify.com/gochujang) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 91.7% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 item processeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

### What does Domain Breach Checker do?

**Domain Breach Checker** is a fast, automated **domain breach checker** and **data breach lookup** tool built on Have I Been Pwned (HIBP) — the world's largest and most trusted public breach database. It works as a comprehensive **HIBP domain scanner** that returns the full breach database export (600+ breaches, no API key needed), domain-level breach detection showing which employee accounts were exposed, and per-email breach lookups. All results are structured JSON ready for compliance reports, SIEM pipelines, or automated monitoring workflows.

### Why use Domain Breach Checker?

**Security teams, compliance officers, and risk managers** choose this actor because it delivers enterprise-grade breach intelligence at a fraction of the cost of commercial platforms.

- **CISO compliance reporting** — Generate breach exposure reports for ISO 27001, SOC 2, and GDPR audits in minutes rather than days. The actor returns every breach record with data types, dates, and affected counts.
- **Third-party vendor risk** — Check whether a vendor's domain appears in known breaches before signing a contract. A single domain check costs $0.01 versus $10,000+/year for commercial platforms.
- **Employee credential monitoring** — Detect when staff email addresses appear in newly disclosed breaches before attackers can exploit leaked passwords for credential stuffing attacks.
- **Incident response** — When a breach is announced, immediately determine whether your organization's domains or emails are among the affected accounts.
- **M\&A due diligence** — Assess a target company's breach history to quantify cybersecurity risk and negotiate deal terms accordingly.

### How to use Domain Breach Checker

1. Click **Try for free** on the Apify Store listing.
2. To export the **full breach database** (no key needed): leave `checkAllBreaches: true` and run. You get all 600+ breaches with metadata, data types, and affected counts.
3. To check **specific domains**: add your HIBP API key in `hibpApiKey` and list domains in `domains`.
4. To check **specific emails**: add your HIBP API key and list addresses in `emails`.
5. Optionally filter with `dataClasses` (e.g. `["Passwords"]`) or `breachAfterDate` (e.g. `"2022-01-01"`).
6. Click **Start** and download results as JSON or CSV.

### Input

| Field | Required | Default | Description |
|---|---|---|---|
| `checkAllBreaches` | No | `true` | Fetch full **HIBP breach database** (600+ breaches, free — no API key) |
| `domains` | No | — | Domains to run **domain breach lookup** against (requires `hibpApiKey`) |
| `emails` | No | — | Email addresses to check individually (requires `hibpApiKey`) |
| `hibpApiKey` | No | — | **HIBP API key** for domain and email lookups ($4/month at haveibeenpwned.com) |
| `dataClasses` | No | — | Filter breaches by data type: `Passwords`, `Credit cards`, `Phone numbers`, etc. |
| `breachAfterDate` | No | — | Only return breaches after this date (`YYYY-MM-DD`) |

#### Example Input

```json
{
  "checkAllBreaches": true,
  "domains": ["yourcompany.com", "vendor.io"],
  "emails": ["cto@yourcompany.com"],
  "hibpApiKey": "your-key-here",
  "dataClasses": ["Passwords"],
  "breachAfterDate": "2020-01-01"
}
```

### Output

The actor pushes up to four record types to the dataset.

#### breach\_record — full database scan

```json
{
  "type": "breach_record",
  "Name": "Adobe",
  "Title": "Adobe",
  "Domain": "adobe.com",
  "BreachDate": "2013-10-04",
  "PwnCount": 152445165,
  "Description": "In October 2013, 153 million Adobe accounts were breached...",
  "DataClasses": ["Email addresses", "Password hints", "Passwords", "Usernames"],
  "IsVerified": true,
  "IsSensitive": false
}
```

#### domain\_result — from domain breach check

```json
{
  "type": "domain_result",
  "domain": "yourcompany.com",
  "status": "breached",
  "total_accounts_breached": 47,
  "breach_names": ["Adobe", "LinkedIn", "Dropbox"],
  "sample_emails": ["alice@yourcompany.com", "bob@yourcompany.com"]
}
```

### Data fields

| Field | Description |
|---|---|
| `Name` | Internal breach identifier |
| `Title` | Human-readable breach name |
| `Domain` | Domain associated with the breached service |
| `BreachDate` | Date the breach occurred (`YYYY-MM-DD`) |
| `PwnCount` | Number of accounts compromised in this breach |
| `DataClasses` | Types of data exposed (passwords, emails, phone numbers, etc.) |
| `IsVerified` | `true` if HIBP has independently verified the breach data |
| `IsSensitive` | `true` if the breach involves sensitive categories |
| `status` | For domain/email results: `breached` or `clean` |
| `total_accounts_breached` | Count of accounts at that domain found across all breaches |
| `breach_names` | List of breaches where the domain's accounts appear |

### Cost estimation

| Feature | Unit Cost | Example |
|---|---|---|
| Actor start | $0.001 | One-time per run |
| Full breach database export | $0.002 per breach record | 600 breaches ≈ $1.20 |
| Domain breach check | $0.01 per domain | 10 domains = $0.10 |
| Filtered export (passwords only, post-2022) | $0.002 per record returned | ~100 records ≈ $0.20 |

**Compare to commercial alternatives:**

| Tool | Cost |
|---|---|
| DarkWebID | $20+/user/month |
| Recorded Future | $25,000+/year |
| SpyCloud | $10,000+/year enterprise |
| **This actor** | Pay only for what you check |

### FAQ

**Do I need a paid HIBP API key to use this?**
The **full breach database export** (600+ breach records with metadata) is completely free — no API key required. A HIBP API key ($4/month) is only needed for domain-level lookups (which accounts at your domain were exposed) and per-email checks.

**Does the actor expose actual passwords from breaches?**
No. Have I Been Pwned does not expose raw password data — only metadata about breaches including which data types were compromised, the date, affected count, and breach description. This is by design to protect users while still enabling exposure monitoring.

**Can I schedule this for ongoing monitoring?**
Yes. Use Apify's built-in **scheduler** to run this actor weekly or monthly against your domain and email list. Connect Apify **webhooks** to push new breach alerts to Slack, email, or your SIEM automatically whenever new exposures are detected.

***

*Data source: [Have I Been Pwned](https://haveibeenpwned.com) created by security researcher Troy Hunt. HIBP is trusted by Microsoft, 1Password, the Australian Signals Directorate, and the UK National Cyber Security Centre. HIBP does not index all dark web dumps — some breaches may not appear in the database.*

***

### Related actors

- [Domain Attack Surface Suite](https://apify.com/gochujang/domain-attack-surface-suite) — SSL, subdomain enumeration, and breach check in one comprehensive security audit
- [npm Package Security Scanner](https://apify.com/gochujang/npm-package-security-scanner) — JavaScript dependency vulnerabilities to pair with domain breach history for full stack security view
- [DeFi Hack Monitor](https://apify.com/gochujang/defi-hack-monitor) — Protocol-level exploit history for crypto projects whose domains you are breach-checking

### Feedback

If this actor helps your security research, a review helps others find it: [Leave a review on Apify Store](https://apify.com/gochujang/domain-breach-checker#reviews)

***

**Keywords:** data breach checker, Have I Been Pwned, HIBP domain check, credential leak detector, email breach lookup, domain breach history, password exposure, data leak monitor, cyber security scraper, brand breach monitoring, breach database, exposed credentials, dark web check

# Actor input Schema

## `domains` (type: `array`):

List of domains to check for breaches (e.g. adobe.com, linkedin.com). Requires hibpApiKey.

## `emails` (type: `array`):

Email addresses to check against HIBP. Requires hibpApiKey.

## `hibpApiKey` (type: `string`):

Have I Been Pwned API key. Required for domain and email checking. Get one at haveibeenpwned.com/API/Key ($4/month for first 1000 queries).

## `checkAllBreaches` (type: `boolean`):

Fetch and return the full HIBP breach database (no API key required). Useful for security research and awareness.

## `dataClasses` (type: `array`):

Only include breaches that exposed these data types. Leave empty to include all.

## `breachAfterDate` (type: `string`):

Filter to only show breaches discovered/added after this date. Format: YYYY-MM-DD

## `alertNewBreaches` (type: `boolean`):

Use named KVS to track breach counts across runs; alert when new breaches detected.

## `telegramBotToken` (type: `string`):

Telegram bot token for sending alerts (e.g. 123456:ABC-DEF...).

## `telegramChatId` (type: `string`):

Telegram chat ID to send alerts to (e.g. -1001234567890).

## Actor input object example

```json
{
  "domains": [
    "adobe.com",
    "linkedin.com"
  ],
  "emails": [
    "user@example.com"
  ],
  "checkAllBreaches": true,
  "breachAfterDate": "2020-01-01",
  "alertNewBreaches": false
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("gochujang/domain-breach-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("gochujang/domain-breach-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call gochujang/domain-breach-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,gochujang/domain-breach-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/450KBPio93DIc2v7z/builds/hvnnNcp2yTO9uobyj/openapi.json