Data Breach Directory Scraper - 1000+ Known Breaches, No API Key

Scrape the complete public data breach directory in one run: 1000+ documented data breaches, each with the breach date, how many accounts were compromised, exactly which classes of data leaked (passwords, credit cards, physical addresses, phone numbers...), verification status and a ready-to-use severity score.

No API key. No login. No proxies needed. One click, structured JSON/CSV/Excel out.

Privacy first: this Actor uses only the public, keyless HaveIBeenPwned breach-directory endpoints. It does not look up individual accounts, email addresses or passwords - the account-search API is key-gated and is deliberately never called. You get breach metadata about companies and services, never personal data.

---

What you get

Every run returns one row per breach:

Field	Description
name / title	Breach identifier and display name (e.g. Adobe)
domain	Breached domain, e.g. adobe.com
breach_date	When the breach happened (ISO date)
added_date / modified_date	When it was published / last updated (ISO 8601)
pwn_count	Number of compromised accounts
pwn_count_millions	Same figure in millions, rounded - great for charts
description	Plain-text summary (HTML stripped, capped at 3000 chars)
logo_url	Company logo
data_classes	Full list of leaked data types
data_class_count	How many distinct data types leaked
has_passwords	Passwords were part of the dump
has_emails	Email addresses were part of the dump
has_payment_data	Credit card / bank / payment data leaked
is_verified, is_fabricated, is_sensitive, is_retired, is_spam_list, is_malware	Quality and classification flags
severity	critical (passwords + >10M accounts), high (passwords), medium
url	Direct link to the breach entry
source, scraped_at	Provenance

Sample output

{
  "name": "Adobe",
  "title": "Adobe",
  "domain": "adobe.com",
  "breach_date": "2013-10-04",
  "added_date": "2013-12-04T00:00:00+00:00",
  "pwn_count": 152445165,
  "pwn_count_millions": 152.45,
  "description": "In October 2013, 153 million Adobe accounts were breached...",
  "logo_url": "https://logos.haveibeenpwned.com/Adobe.png",
  "data_classes": ["Email addresses", "Password hints", "Passwords", "Usernames"],
  "data_class_count": 4,
  "has_passwords": true,
  "has_emails": true,
  "has_payment_data": false,
  "is_verified": true,
  "severity": "critical",
  "url": "https://haveibeenpwned.com/PwnedWebsites#Adobe",
  "source": "hibp",
  "scraped_at": "2026-07-28T09:12:44+00:00"
}

---

Use cases

• Security awareness training - pull real, dated breach examples with account counts to make phishing and password-reuse training land. Filter to has_passwords: true for credential-hygiene modules.
• Vendor risk assessment - feed your supplier domain list into domains mode and instantly see which vendors have a documented breach history, how severe, and what data was exposed.
• Compliance reporting - build GDPR/SOC 2/ISO 27001 evidence packs and board slides with sourced breach statistics, dates and data-class breakdowns.
• Breach research & journalism - analyse trends over time: breaches per year, average records per incident, which data classes leak most often, share of payment-data breaches.

---

Input

Option	Type	Default	Notes
mode	select	all	all = full directory, domains = only the entries you list
domains	array	[]	e.g. ["adobe.com", "linkedin.com"] - domains, breach names or titles
minPwnCount	integer	0	Skip breaches smaller than this
dataClassFilter	string	-	e.g. Passwords, Credit cards, Phone numbers
verifiedOnly	boolean	false	Keep only verified breaches
maxItems	integer	500	Cap results (max 2000), sorted biggest first

Example: every breach that leaked passwords and hit 1M+ accounts

{
  "mode": "all",
  "minPwnCount": 1000000,
  "dataClassFilter": "Passwords",
  "verifiedOnly": true,
  "maxItems": 500
}

Example: vendor risk check

{
  "mode": "domains",
  "domains": ["adobe.com", "linkedin.com", "dropbox.com", "canva.com"]
}

---

Pricing

Roughly $0.50 per 1,000 breach records. The whole directory (1000+ breaches) fetches in a single HTTP request, so a full run finishes in seconds and costs pennies - no proxy fees, no API subscription.

---

FAQ

Do I need a HaveIBeenPwned API key? No. The breach-directory endpoints used here are free and keyless.

Can I check whether my email was breached? Not with this Actor. Account lookups require a paid key and involve personal data; this Actor intentionally only returns breach metadata about services and companies.

How fresh is the data? The directory is fetched live on every run, so newly published breaches appear immediately.

Which output formats are supported? JSON, CSV, Excel, XML, HTML table and RSS via the Apify dataset API, plus webhooks and scheduled runs.

---

Related Actors

• IP Threat Intel Scraper - reputation and abuse data for IP addresses
• CIRCL CVE Scraper - vulnerability records with CVSS scores
• Domain Intel Scraper - WHOIS, DNS and domain intelligence
• SSL Certificate Checker - certificate validity, expiry and chain checks

---

Data source: the public HaveIBeenPwned breach directory. This Actor is not affiliated with or endorsed by HaveIBeenPwned.