# WA Data Breach Notifications - Security Intelligence (`j0401/wa-data-breach`) Actor

Washington data-breach notifications (1,653, WA AG, 2017-present): breached organization, industry, cause (cyberattack / unauthorized access), attack type (ransomware / phishing), Washingtonians affected. Filter by industry, attack type, date or minimum affected; screen vendors and suppliers.

- **URL**: https://apify.com/j0401/wa-data-breach.md
- **Developed by:** [Wenhao Yang](https://apify.com/j0401) (community)
- **Categories:**
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$2.00 / 1,000 wa data breach notification records

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## WA Data Breach Notifications (`wa-data-breach`)

Pull **Washington data-breach notifications** - **1,653 breaches filed with the WA Attorney General** (2015-present, free public open data). Every time a business, healthcare organization or government body discovers a breach affecting **500+ Washington residents**, state law requires them to file one of these.

This is a **security-intelligence feed**: who got breached in WA, in what industry, by what kind of attack, and how many Washingtonians were exposed.

Built for **security researchers, auditors, vendor-screening and supply-chain teams, insurance underwriters, journalists and market-intelligence users** - the question "has this organization / this industry / this vendor ever had a WA data breach?" answered in one query.

### What this data is

Each record is **one breach notification**:

| Field | Meaning |
|---|---|
| `name` | The breached organization |
| `industryType` | `Business` / `Health` / `Finance` / `Education` / `Government` / `Non-Profit/Charity` |
| `businessType` | Finer business category (e.g. `Software`, `Medical`) |
| `breachCause` | `Cyberattack` / `Unauthorized Access` / `Theft or Mistake` |
| `cyberAttackType` | `Ransomware` / `Malware` / `Phishing` / `Skimmers`... |
| `washingtoniansAffected` | WA residents exposed (source also carries a range) |
| `year` / `dateSubmitted` | When the notification was filed |
| `daysToContain` | Days from discovery to containment (where known) |

> **Note on scope**: notifications are required at ~500+ WA residents affected, so this is the *reportable* tail of breaches, not every incident. It still shows the industry and attack-vector mix clearly (ransomware dominates; Health is the top non-Business industry).

### Typical questions it answers

- **Ransomware victims in WA** - filter `cyberAttackType=Ransomware`, sort by Washingtonians affected.
- **Healthcare breaches** - filter `industryType=Health` (+ a `yearFrom`). 326 Health notifications on file.
- **Has this company ever reported a breach here?** - filter `name=...` (e.g. "Premera", "Delta").
- **Large-impact incidents** - `minAffected=10000`.
- **Newest activity** - leave everything blank; you get the latest notifications first.

### Inputs (all optional)

| Input | What it does |
|---|---|
| `name` | Breached organization (substring) |
| `keywords` | Match across org name / industry / business type |
| `industryType` | Industry (Business / Health / Finance / Education / Government) |
| `breachCause` | Cyberattack / Unauthorized Access / Theft or Mistake |
| `cyberAttackType` | Attack type (substring: Ransomware, Phishing, ...) |
| `minAffected` | At least N Washingtonians affected |
| `yearFrom` / `yearTo` | Notification-year range |
| `maxResults` | Cap records (default 200) |

### Low cost & full coverage

**$0.002 per record** returned, with a per-run charge cap so no surprise bills.

**Every breach notification on file is in the dataset** - the full 1,653 reportable breaches (2015-present). Runs scan the whole set and return exactly what matches your filters. One source quirk handled for you: the dataset's own `year` field is the *state fiscal year of reporting*, which runs **ahead of the real filing date** (a breach filed in Aug 2026 can be stamped 2027), so all date filtering here runs off the actual submission date rather than the label that would silently mislead a naive pull.

### Data source & freshness

- **Source**: [data.wa.gov - WA AG Data Breach Notifications](https://data.wa.gov/) (`sb4j-ca4h`, Socrata SODA API, free public, no login).
- **Update cadence**: the AG publishes notifications as they're filed - through the present.

# Actor input Schema

## `name` (type: `string`):

Return breaches filed by this organization (substring, case-insensitive). E.g. "Delta", "Premera", "Microsoft".

## `keywords` (type: `array`):

Match across organization name, industry or business type (each keyword is a substring). E.g. \["hospital"], \["clinic"], \["insurance"].

## `industryType` (type: `string`):

Only breaches in this industry. Health = healthcare orgs (a top breach target).

## `breachCause` (type: `string`):

The cause of the breach.

## `cyberAttackType` (type: `string`):

Only breaches whose attack type contains this (substring, case-insensitive). E.g. "Ransomware", "Phishing", "Malware".

## `minAffected` (type: `integer`):

Only breaches affecting at least this many Washington residents. E.g. 10000 for large-impact events.

## `yearFrom` (type: `string`):

Only breaches notified in this year or later (e.g. "2024").

## `yearTo` (type: `string`):

Only breaches notified in this year or earlier.

## `maxResults` (type: `integer`):

Cap the number of records pushed (0 = unlimited). The whole corpus is only 1.6k rows.

## Actor input object example

```json
{
  "minAffected": 0,
  "maxResults": 200
}
```

# Actor output Schema

## `recordsUrl` (type: `string`):

Washington data-breach notifications - as JSON

## `datasetUrl` (type: `string`):

No description

## `runUrl` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("j0401/wa-data-breach").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("j0401/wa-data-breach").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call j0401/wa-data-breach --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,j0401/wa-data-breach"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/i131y0U2qb75KRIfc/builds/qcyqLDbIzmxPF4hhm/openapi.json