# Data Breach Notification Leads (HHS, State AG & SEC 8-K) (`intenal_builds/data-breach-notification-leads`) Actor

Organizations that just reported a data breach to regulators: HHS HIPAA portal, California and Washington Attorney General lists, and SEC 8-K cybersecurity disclosures, merged into one row per organization with people affected, breach type, data exposed, dates and notice links. No API key.

- **URL**: https://apify.com/intenal_builds/data-breach-notification-leads.md
- **Developed by:** [Jaydan Eaton](https://apify.com/intenal_builds) (community)
- **Categories:** Lead generation, Business
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $10.00 / 1,000 breach leads

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Data Breach Notification Leads (HHS, State AG & SEC 8-K)

Get **organizations that just reported a data breach to a regulator**, from four official public sources, merged into **one row per organization**:

- **HHS OCR HIPAA Breach Portal**: healthcare providers, health plans and business associates with a breach of 500+ people (US-wide, with people affected, breach type and where the data was)
- **California Attorney General** data breach list: every industry, with breach dates, notice page and (optional) the consumer notice letter PDF
- **Washington Attorney General** data breach notifications: 500+ WA residents, with people affected, cause, industry, **data types exposed** (SSN, medical, financial, driver's license...) and days to notify
- **SEC 8-K cybersecurity disclosures** (Item 1.05 material incidents and Item 8.01 voluntary disclosures): public companies, with ticker, **phone and business address** from SEC EDGAR

No API key, no login, no proxies. Only organization-level notices are returned: no data about the people affected.

### Why merged rows matter

The same breach often shows up with several regulators under slightly different names. This actor matches them (ignoring Inc/LLC/Corp and punctuation), so you get one row with every notice, the largest reported count, all breach dates and links. In a 2-year test run (2026-10-21): 2,395 notices → **1,827 organizations**, 308 of them filed with 2+ regulators.

### How fresh is it

Checked on 2026-10-21: California's list ran through **2026-10-19** (57 notices in the last 30 days), HHS OCR through **2026-10-01** (765 open reports covering the last 24 months), SEC EDGAR is same-day, and Washington's dataset ran through **2026-09-11** (it updates in batches). Use 30 to 90 days back for a good mix.

### What you get per organization

- Organization name, sources, number of notices, newest and oldest notice date
- **People affected** (HHS and/or Washington), breach dates, breach type / cause, where the data was (network server, email, paper...), **data types exposed**, business associate involved, industry, state, days to notify
- Public companies: tickers, CIK, **phone**, website, business address, SEC filing link
- Links to every notice (HHS portal, California notice page, Washington dataset, SEC filing), plus per-source notice details
- Optional: California consumer notice letter PDF links

### Who uses it

- **Cybersecurity vendors and incident response / MSSP teams**: organizations that just had a breach (filter by hacking, ransomware, email)
- **Cyber insurance agents and underwriters**: fresh loss events by industry, state and size
- **Data breach and privacy law firms**: new breaches with counts, data types and notice letters
- **Healthcare compliance and HIPAA consultants**: providers and business associates on the HHS list
- **Identity protection, credit monitoring and PR/crisis firms**: organizations sending notices right now
- **Researchers, journalists and investors**: breach trends; SEC 8-K material incidents by ticker

### Filters

Sources, days back or start/end date, minimum people affected, organization state, industry keywords (e.g. `Healthcare Provider`, `Business Associate`, `Finance`), breach type keywords (e.g. `hacking`, `ransomware`, `email`), organization name keywords, SEC 8-K items (1.05 / 8.01), only organizations in 2+ sources, California notice letter PDFs on/off, max rows.

### Example input

```json
{
  "sources": ["hhs", "wa"],
  "daysBack": 180,
  "breachTypeKeywords": ["hacking", "ransomware", "malware"],
  "minIndividualsAffected": 10000,
  "maxResults": 50
}
```

### Example output (trimmed)

```json
{
  "organizationName": "Ridgeway Pharmacy, Ltd",
  "sources": ["California Attorney General", "HHS OCR HIPAA Breach Portal"],
  "sourceCount": 2,
  "latestReportedDate": "2026-09-21",
  "individualsAffected": 258920,
  "breachDates": ["2026-06-07"],
  "breachTypes": ["Hacking/IT Incident"],
  "breachedInformationLocation": "Network Server, Other",
  "businessAssociateInvolved": true,
  "industry": "Healthcare Provider",
  "entityState": "MT",
  "noticeUrls": ["https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf", "https://oag.ca.gov/ecrime/databreach/reports/sb24-630056"]
}
```

### Pricing

Pay per result: **$0.01 per organization** ($10 per 1,000) plus a tiny actor-start fee. A 30-day all-source run is about 70 to 80 organizations.

### Notes

- California and SEC notices don't publish people-affected counts, so `minIndividualsAffected` above 0 keeps only HHS and Washington rows.
- California's robots.txt asks for 10 seconds between requests; the actor follows it (about 10 s per 50 notices, plus 10 s per notice letter when enabled).
- SEC 8.01 rows are voluntary disclosures where the main 8-K document mentions a cybersecurity incident; Item 1.05 rows are formal material-incident filings.
- Data comes from official government sources (HHS OCR, California DOJ, Washington AGO via data.wa.gov, SEC EDGAR). Check the linked notice before acting on any row.

# Actor input Schema

## `sources` (type: `array`):

Official breach notice sources to read. hhs = HHS OCR HIPAA Breach Portal (healthcare, 500+ people, US-wide); ca = California Attorney General list (all industries); wa = Washington Attorney General (500+ WA residents, with data types); sec = SEC 8-K cybersecurity incident filings (public companies, with phone and address).

## `daysBack` (type: `integer`):

Notices reported in the last N days (ending today or at End date). HHS and Washington post with a lag of a few weeks, so 30 to 90 days gives the best mix.

## `startDate` (type: `string`):

YYYY-MM-DD. Overrides Days back.

## `endDate` (type: `string`):

YYYY-MM-DD. Defaults to today.

## `minIndividualsAffected` (type: `integer`):

Keep only organizations whose HHS or Washington notice reports at least this many people. California and SEC notices don't publish counts, so they are dropped when this is set above 0.

## `entityStates` (type: `array`):

Two-letter state of the organization (HHS, Washington and SEC give it), e.g. TX, NY. Empty = all.

## `industryKeywords` (type: `array`):

Keep organizations whose industry contains any of these, e.g. Healthcare Provider, Health Plan, Business Associate, Finance, Education, Retail, Government.

## `breachTypeKeywords` (type: `array`):

Keep organizations whose breach type or cause contains any of these, e.g. hacking, ransomware, malware, phishing, unauthorized, theft, email, network server.

## `organizationKeywords` (type: `array`):

Keep organizations whose name contains any of these, e.g. clinic, dental, bank, school.

## `secItems` (type: `array`):

Which 8-K items count. 1.05 = material cybersecurity incident (required filing); 8.01 = voluntary cybersecurity disclosure.

## `multiSourceOnly` (type: `boolean`):

Keep only organizations that filed with more than one regulator in the window (usually the larger breaches).

## `maxResults` (type: `integer`):

Stop after this many rows. You pay per row.

## `includeNoticeLetters` (type: `boolean`):

Open each California notice page to add the link to the consumer notice letter PDF (what happened, what data, dates). Slower: one page every 10 seconds, as the site's robots.txt asks.

## `userAgent` (type: `string`):

Override the declared User-Agent sent to the official sources.

## Actor input object example

```json
{
  "sources": [
    "hhs",
    "ca",
    "wa",
    "sec"
  ],
  "daysBack": 30,
  "secItems": [
    "1.05",
    "8.01"
  ],
  "multiSourceOnly": false,
  "maxResults": 200,
  "includeNoticeLetters": false
}
```

# Actor output Schema

## `results` (type: `string`):

One item per organization.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "sources": [
        "hhs",
        "ca",
        "wa",
        "sec"
    ],
    "daysBack": 30,
    "maxResults": 200
};

// Run the Actor and wait for it to finish
const run = await client.actor("intenal_builds/data-breach-notification-leads").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "sources": [
        "hhs",
        "ca",
        "wa",
        "sec",
    ],
    "daysBack": 30,
    "maxResults": 200,
}

# Run the Actor and wait for it to finish
run = client.actor("intenal_builds/data-breach-notification-leads").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "sources": [
    "hhs",
    "ca",
    "wa",
    "sec"
  ],
  "daysBack": 30,
  "maxResults": 200
}' |
apify call intenal_builds/data-breach-notification-leads --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,intenal_builds/data-breach-notification-leads"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/1zyUL7ZQLYR3GmhY9/builds/Nv7e6vUGW7C6mZ9s4/openapi.json