Email Breach Checker — Structured Exposure Reports

Check 1–50 email addresses you own or are authorized to investigate for known breach exposure. The Actor returns one structured dataset record per completed address with breach names, dates, affected domains, exposed data classes, account counts, source attribution, and the time of the check. Managed access is included, so callers provide no external API key.

Best fit for this Actor

• Use it for internal security reviews, incident-response triage, and scheduled checks of approved operational mailboxes.
• Choose the default verified-only setting for a conservative report, or include unverified breach records when the investigation calls for broader context.
• Start with a focused mailbox list and retain checkedAt with each security decision because breach coverage changes over time.

Focused standalone workflow

This Actor works as a focused standalone workflow for email breach exposure checks. Its output is ready for security dashboards, audit records, alerts, spreadsheets, and downstream automation.

From an approved mailbox list to a security decision

A security owner starts with the organization’s approved support, billing, and administrator addresses. They submit the list with a bounded event-spend cap, then review breached, breachCount, exposedDataClasses, and the dated entries in breaches. Password-related exposure can trigger credential rotation and session review, while a clean report remains a useful time-bounded observation for the audit record.

Quick start input

{
  "emails": [
    "security@example.com",
    "it@example.com"
  ],
  "includeUnverified": false,
  "maxRunCostUsd": 0.02
}

Addresses are trimmed, lowercased, and deduplicated before lookup. The batch limit is 50 unique addresses.

Input reference

Field	Type	What it controls
emails	array of strings	One to 50 complete email addresses, such as security@example.com, that the requester owns or is authorized to investigate.
includeUnverified	boolean	Includes unverified breach entries when true. The default false keeps the report focused on verified, non-sensitive, active records.
maxRunCostUsd	number	Caps Pay per event spending for completed email reports. Apify platform usage is reported separately.

What data you receive

One dataset item represents one completed email lookup. A clean address still produces a record with breached: false, breachCount: 0, and an empty breaches array.

Field	Meaning
email	Normalized address checked in this record.
breached	true when at least one included breach record is present.
breachCount	Number of included breach records for the address.
exposedDataClasses	Unique exposed-data categories across the included breaches.
breaches	Structured breach names, titles, domains, dates, affected-account counts, data classes, and verification flags.
provider	Source attribution attached to the report.
sourceUrl	Source documentation or attribution URL.
checkedAt	ISO 8601 timestamp for this time-bounded observation.

Illustrative schema-valid item:

{
  "email": "security@example.com",
  "breached": true,
  "breachCount": 1,
  "exposedDataClasses": [
    "Email addresses",
    "Passwords"
  ],
  "breaches": [
    {
      "name": "ExampleBreach",
      "title": "Example Breach",
      "domain": "example.com",
      "breachDate": "2020-01-01",
      "addedDate": "2020-02-01T00:00:00Z",
      "modifiedDate": "2020-02-01T00:00:00Z",
      "pwnCount": 1000000,
      "dataClasses": [
        "Email addresses",
        "Passwords"
      ],
      "isVerified": true,
      "isSensitive": false,
      "isRetired": false,
      "isSpamList": false
    }
  ],
  "provider": "<source attribution>",
  "sourceUrl": "https://example.com/source-attribution",
  "checkedAt": "2026-01-01T00:00:00.000Z"
}

The Actor stores normalized breach metadata and terminal diagnostics. Submitted passwords, password hashes, external credentials, authorization headers, and raw source responses stay outside the dataset and terminal records.

Outcomes and readback

Every execution writes the dataset plus two key-value-store records: OUTPUT for compact automation decisions and RUN_SUMMARY for detailed counts, warnings, billing totals, and continuation context.

Outcome	Meaning
COMPLETE	Every requested address produced a persisted report.
PARTIAL	Useful reports were persisted; RUN_SUMMARY identifies completed work and remaining warnings.
VALID_EMPTY	A valid workflow completed without a dataset entity; ordinary clean email checks still produce persisted reports.
INVALID_INPUT	The supplied address list needs a complete email format or an allowed batch size.
CONFIG_ERROR	Managed source access needs owner configuration before the lookup can continue.
UPSTREAM_FAILED	The source route produced no usable report after bounded attempts.

Use OUTPUT.outcome as the automation branch, then read the complete dataset and RUN_SUMMARY before acting on the result. A successful Apify status alone represents execution state; the terminal records carry the business outcome.

Pricing

This Actor uses Pay per event plus Apify platform usage. Each completed, persisted email report creates one email-breach-check event, including a clean report, and the start event covers initialization. Set maxRunCostUsd to bound report-event spending; Apify platform usage remains a separate line item. Open the live Actor Pricing tab for the current event rates and platform-usage terms.

Event-cost formula:

completed reports × email-breach-check event rate + Actor start event

Use through the API

Start an execution with the real Actor slug:

curl -X POST "https://api.apify.com/v2/acts/khadinakbar~email-breach-checker/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "emails": ["security@example.com"],
    "includeUnverified": false,
    "maxRunCostUsd": 0.01
  }'

Use the returned defaultDatasetId to retrieve every report:

curl -H "Authorization: Bearer $APIFY_TOKEN" \
  "https://api.apify.com/v2/datasets/$DATASET_ID/items?clean=true&format=json"

For multi-address batches, paginate the dataset until every persisted report has been read.

Use with AI agents through Apify MCP

Configure the Actor through https://mcp.apify.com, then give the agent a bounded, authorized objective:

Check these authorized operational email addresses for known breach exposure. Keep includeUnverified false, cap report-event cost with maxRunCostUsd, read OUTPUT, RUN_SUMMARY, and the complete dataset, then return breached, breachCount, exposedDataClasses, breach dates, source URL provenance, and checkedAt. State the terminal outcome and paginate when the dataset preview is incomplete.

The Actor performs a read-only lookup and writes results only to its Apify dataset and key-value store. Agents can use OUTPUT.outcome for branching and sourceUrl plus checkedAt for provenance.

Best results

• Provide complete email addresses from an approved scope and keep each batch focused on one review or incident.
• Start with includeUnverified: false; enable it when broader investigative context is useful.
• Set maxRunCostUsd before execution so automation has a clear report-event boundary.
• Preserve checkedAt and sourceUrl when exporting findings because every report is a dated observation.
• Confirm OUTPUT.outcome, read RUN_SUMMARY, and retrieve the full dataset before starting remediation.

Responsible use

Submit only addresses you own or are explicitly authorized to investigate. Handle email addresses and resulting security observations under applicable law, organizational policy, retention rules, and disclosure requirements. Treat each result as decision support for a qualified security review.

Builder's note

I designed the data contract around one complete, normalized record per checked address. I found that this makes clean and breached results equally useful in automation: both carry a timestamp, source attribution, billing unit, and terminal context, while detailed breach entries remain easy to filter by date, domain, verification status, or exposed data class.