Email Breach Checker — Structured Reports

What is Email Breach Checker — Structured Reports?

Email Breach Checker — Structured Reports checks 1 to 50 email addresses that you own or are authorized to investigate and returns one structured breach-history report per address. Each dataset row shows whether the address appears in known breach sources, the breachCount, every breach name with its breachDate and exposed dataClasses, a combined exposedDataClasses list, source attribution and the checkedAt time. Security teams, IT administrators, incident responders and AI agents use it for approved account-hygiene reviews and triage, with managed access so callers supply no external API key.

Best fit for this Actor

• Designed for authorized security work. Use it for organization-controlled mailboxes, approved incident-response triage and periodic hygiene checks of shared and role addresses.
• A report per address, clean or not. A clean address returns breached: false with an empty breaches array, so every requested email has a row you can file.
• Ready for prioritization. exposedDataClasses merges what was exposed across all breaches, so you can rank addresses where password appears first.
• Spend cap built in. maxRunCostUsd caps the report events for the run, which suits scheduled checks.
• Mailbox health alongside exposure. When you also want to confirm that each address is valid and deliverable, then pass the same list to Email Address Validator.

What people and AI agents ask this Actor to do

Check our shared security and IT mailboxes for known breach exposure. Which of these company addresses had passwords exposed? Run a monthly breach check on our role addresses and summarize anything new.

Request	Input to send
One address	{"emails": ["security@example.com"]}
A team's role mailboxes	{"emails": ["it@example.com", "billing@example.com", "office@example.com"]}
A capped scheduled check	{"emails": ["security@example.com", "it@example.com"], "maxRunCostUsd": 0.5}

Workflow example: a quarterly mailbox hygiene review

An IT lead starts with the organization's 30 shared and role addresses and runs them in one batch with a modest maxRunCostUsd. The dataset returns one report per address. The lead filters for rows where exposedDataClasses contains password, sorts them by breachCount, and opens password-reset and MFA tickets for those mailboxes first. They export the reports to the security log and schedule the same input each quarter to compare breachCount per address and spot newly listed breaches.

How to check email breach exposure

1. Add the authorized addresses in Emails, one per line.
2. Optionally set Max run cost (USD) to cap report events.
3. Click Start, then read the dataset and the OUTPUT record.

Input

{
  "emails": ["security@example.com", "it@example.com"],
  "includeUnverified": false,
  "maxRunCostUsd": 10
}

Field	Type	What it controls
emails	array (required)	1 to 50 complete email addresses you are authorized to check. Entries are trimmed, lowercased and deduplicated.
includeUnverified	boolean	Kept so saved inputs keep working; results are the same with either value. Default false.
maxRunCostUsd	number	Caps report-event spend for the run, from 0.01 to 10. Default 10, which covers a full 50-address batch.

Output

Each dataset row is one completed report for one email address.

Field	What it contains
email	The normalized address that was checked
breached, breachCount	Whether the address appears in known breach sources, and in how many
exposedDataClasses	All exposed data types across the address's breaches, such as password, ip or phone
breaches[].name	Breach or source name
breaches[].breachDate	Breach date, often as year and month, when the source provides it
breaches[].dataClasses	Data types exposed in that breach
breaches[] other keys	title, domain, addedDate, modifiedDate, pwnCount and verification flags, kept in a stable shape and filled when the source provides them
provider, sourceUrl	Source attribution
checkedAt	Time of the check

Example report, with the breaches array trimmed to two entries for readability:

{
  "email": "contact@example.com",
  "breached": true,
  "breachCount": 7,
  "exposedDataClasses": ["address", "city", "country", "id", "ip", "name", "origin", "password", "phone", "profile name", "state", "username", "zip"],
  "breaches": [
    {
      "name": "Indiamart.com",
      "title": null,
      "domain": null,
      "breachDate": "2021-05",
      "addedDate": null,
      "modifiedDate": null,
      "pwnCount": null,
      "dataClasses": ["name", "phone", "zip", "country", "state", "id", "password", "origin", "username", "address", "city", "ip", "profile name"],
      "isVerified": null,
      "isSensitive": null,
      "isRetired": null,
      "isSpamList": null
    },
    {
      "name": "Chess.com",
      "title": null,
      "domain": null,
      "breachDate": "2026-08",
      "addedDate": null,
      "modifiedDate": null,
      "pwnCount": null,
      "dataClasses": ["name", "phone", "zip", "country", "state", "id", "password", "origin", "username", "address", "city", "ip", "profile name"],
      "isVerified": null,
      "isSensitive": null,
      "isRetired": null,
      "isSpamList": null
    }
  ],
  "provider": "LeakCheck Public API (breach sources)",
  "sourceUrl": "https://docs.leakcheck.io/public-api",
  "checkedAt": "2026-09-28T20:54:07.423Z"
}

A clean report looks like this:

{
  "email": "office@example.com",
  "breached": false,
  "breachCount": 0,
  "exposedDataClasses": [],
  "breaches": [],
  "provider": "LeakCheck Public API (breach sources)",
  "sourceUrl": "https://docs.leakcheck.io/public-api",
  "checkedAt": "2026-09-28T20:54:04.937Z"
}

Reports hold breach names, dates and data types only; submitted passwords, hashes, credentials and raw source responses are never stored. Every run writes OUTPUT and RUN_SUMMARY with an outcome of COMPLETE, PARTIAL, INVALID_INPUT, CONFIG_ERROR or UPSTREAM_FAILED, so a clean report is always a confirmed empty history.

Pricing

This Actor uses Pay per event with Apify platform usage included in the event price. Two events apply: Actor Start once per run, and Email breach check once per completed report, including clean reports. For example, a batch of 20 addresses that all complete creates 20 Email breach check events plus one Actor Start event. maxRunCostUsd caps the report events in a run. The live Pricing tab on this page shows the current event prices.

API example

curl -X POST "https://api.apify.com/v2/acts/khadinakbar~email-breach-checker/run-sync-get-dataset-items?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"emails": ["security@example.com", "it@example.com"], "maxRunCostUsd": 0.5}'

from apify_client import ApifyClient

client = ApifyClient("YOUR_API_TOKEN")
run = client.actor("khadinakbar/email-breach-checker").call(run_input={
    "emails": ["security@example.com", "it@example.com"],
})
for report in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(report["email"], report["breached"], report["breachCount"])

Use with AI agents through Apify MCP

Connect this Actor to Claude, ChatGPT, Cursor or any MCP client through Apify MCP, then ask:

Check these authorized company addresses for known breach history: security@example.com, it@example.com. For each, report breached, breachCount, the breach names with dates, and whether a password was exposed. Include the checkedAt time and the run outcome.

Agent checklist:

1. Pass only addresses the user owns or is authorized to check, and set maxRunCostUsd as the cost ceiling.
2. Read OUTPUT.outcome first; COMPLETE and PARTIAL mean reports are ready to read.
3. Read the full dataset with get-dataset-items, since one report is one row.
4. Quote checkedAt and the provider attribution with every finding.

Best results

Starting situation	Helpful action	Expected outcome
A long staff list	Split it into batches of up to 50	One report per address per batch
Prioritizing follow-up	Filter rows where exposedDataClasses contains password	A short list for resets and MFA checks
Ongoing monitoring	Schedule the same list and compare breachCount by email	New exposures stand out between runs
Budget control	Set maxRunCostUsd before scheduling	Predictable spend per run

Builder's note

I built this for security reviews where every address needs a clear answer, so the Actor writes a report for clean addresses too and records the source and check time on each row. I learned that reviewers act on what was exposed more than on breach counts, which is why each report merges the exposed data types into one list. My goal was a report that is safe to store, which is why rows hold breach metadata only and never credentials.

Attribution

Breach history comes from the LeakCheck public breach-source index. Each row, OUTPUT and RUN_SUMMARY carries that attribution in provider and sourceUrl; keep the "Powered by LeakCheck" credit when you share or redistribute these reports.

Responsible use

Use this Actor only for lawful, authorized cybersecurity and safety purposes, on addresses you own or have explicit permission to check. Email addresses and breach observations are personal data under laws such as the GDPR and CCPA, so apply your organization's retention, disclosure and access-control rules. Treat results as decision support for security follow-up, and keep them out of employment, credit, insurance or other high-impact decisions about people.