# Data Breach Directory Scraper - HIBP Breaches, No API Key (`ninhothedev/data-breach-scraper`) Actor

$0.5/1K 🔥 Data breach directory scraper! 1000+ known breaches with dates, account counts & leaked data types. No key. JSON, CSV, Excel or API in seconds. Power risk & compliance reports ⚡

- **URL**: https://apify.com/ninhothedev/data-breach-scraper.md
- **Developed by:** [ninhothedev](https://apify.com/ninhothedev) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.50 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Data Breach Directory Scraper - 1000+ Known Breaches, No API Key

Scrape the complete public data breach directory in one run: **1000+ documented data breaches**, each with the breach date, how many accounts were compromised, exactly which classes of data leaked (passwords, credit cards, physical addresses, phone numbers...), verification status and a ready-to-use severity score.

No API key. No login. No proxies needed. One click, structured JSON/CSV/Excel out.

> **Privacy first:** this Actor uses **only the public, keyless HaveIBeenPwned breach-directory endpoints**. It **does not look up individual accounts, email addresses or passwords** - the account-search API is key-gated and is deliberately never called. You get breach *metadata* about companies and services, never personal data.

***

### What you get

Every run returns one row per breach:

| Field | Description |
|---|---|
| `name` / `title` | Breach identifier and display name (e.g. `Adobe`) |
| `domain` | Breached domain, e.g. `adobe.com` |
| `breach_date` | When the breach happened (ISO date) |
| `added_date` / `modified_date` | When it was published / last updated (ISO 8601) |
| `pwn_count` | Number of compromised accounts |
| `pwn_count_millions` | Same figure in millions, rounded - great for charts |
| `description` | Plain-text summary (HTML stripped, capped at 3000 chars) |
| `logo_url` | Company logo |
| `data_classes` | Full list of leaked data types |
| `data_class_count` | How many distinct data types leaked |
| `has_passwords` | Passwords were part of the dump |
| `has_emails` | Email addresses were part of the dump |
| `has_payment_data` | Credit card / bank / payment data leaked |
| `is_verified`, `is_fabricated`, `is_sensitive`, `is_retired`, `is_spam_list`, `is_malware` | Quality and classification flags |
| `severity` | `critical` (passwords + >10M accounts), `high` (passwords), `medium` |
| `url` | Direct link to the breach entry |
| `source`, `scraped_at` | Provenance |

#### Sample output

```json
{
  "name": "Adobe",
  "title": "Adobe",
  "domain": "adobe.com",
  "breach_date": "2013-10-04",
  "added_date": "2013-12-04T00:00:00+00:00",
  "pwn_count": 152445165,
  "pwn_count_millions": 152.45,
  "description": "In October 2013, 153 million Adobe accounts were breached...",
  "logo_url": "https://logos.haveibeenpwned.com/Adobe.png",
  "data_classes": ["Email addresses", "Password hints", "Passwords", "Usernames"],
  "data_class_count": 4,
  "has_passwords": true,
  "has_emails": true,
  "has_payment_data": false,
  "is_verified": true,
  "severity": "critical",
  "url": "https://haveibeenpwned.com/PwnedWebsites#Adobe",
  "source": "hibp",
  "scraped_at": "2026-07-28T09:12:44+00:00"
}
```

***

### Use cases

- **Security awareness training** - pull real, dated breach examples with account counts to make phishing and password-reuse training land. Filter to `has_passwords: true` for credential-hygiene modules.
- **Vendor risk assessment** - feed your supplier domain list into `domains` mode and instantly see which vendors have a documented breach history, how severe, and what data was exposed.
- **Compliance reporting** - build GDPR/SOC 2/ISO 27001 evidence packs and board slides with sourced breach statistics, dates and data-class breakdowns.
- **Breach research & journalism** - analyse trends over time: breaches per year, average records per incident, which data classes leak most often, share of payment-data breaches.

***

### Input

| Option | Type | Default | Notes |
|---|---|---|---|
| `mode` | select | `all` | `all` = full directory, `domains` = only the entries you list |
| `domains` | array | `[]` | e.g. `["adobe.com", "linkedin.com"]` - domains, breach names or titles |
| `minPwnCount` | integer | `0` | Skip breaches smaller than this |
| `dataClassFilter` | string | - | e.g. `Passwords`, `Credit cards`, `Phone numbers` |
| `verifiedOnly` | boolean | `false` | Keep only verified breaches |
| `maxItems` | integer | `500` | Cap results (max 2000), sorted biggest first |

#### Example: every breach that leaked passwords and hit 1M+ accounts

```json
{
  "mode": "all",
  "minPwnCount": 1000000,
  "dataClassFilter": "Passwords",
  "verifiedOnly": true,
  "maxItems": 500
}
```

#### Example: vendor risk check

```json
{
  "mode": "domains",
  "domains": ["adobe.com", "linkedin.com", "dropbox.com", "canva.com"]
}
```

***

### Pricing

Roughly **$0.50 per 1,000 breach records**. The whole directory (1000+ breaches) fetches in a single HTTP request, so a full run finishes in seconds and costs pennies - no proxy fees, no API subscription.

***

### FAQ

**Do I need a HaveIBeenPwned API key?**
No. The breach-directory endpoints used here are free and keyless.

**Can I check whether *my* email was breached?**
Not with this Actor. Account lookups require a paid key and involve personal data; this Actor intentionally only returns breach metadata about services and companies.

**How fresh is the data?**
The directory is fetched live on every run, so newly published breaches appear immediately.

**Which output formats are supported?**
JSON, CSV, Excel, XML, HTML table and RSS via the Apify dataset API, plus webhooks and scheduled runs.

***

### Related Actors

- [IP Threat Intel Scraper](https://apify.com/ninhothedev/ip-threat-intel-scraper) - reputation and abuse data for IP addresses
- [CIRCL CVE Scraper](https://apify.com/ninhothedev/circl-cve-scraper) - vulnerability records with CVSS scores
- [Domain Intel Scraper](https://apify.com/ninhothedev/domain-intel-scraper) - WHOIS, DNS and domain intelligence
- [SSL Certificate Checker](https://apify.com/ninhothedev/ssl-certificate-checker) - certificate validity, expiry and chain checks

***

Data source: the public HaveIBeenPwned breach directory. This Actor is not affiliated with or endorsed by HaveIBeenPwned.

# Actor input Schema

## `mode` (type: `string`):

How to select breaches. 'all' scrapes the full public breach directory (optionally narrowed by the filters below). 'domains' returns only the breaches you list in the 'Domains or breach names' field.

## `domains` (type: `array`):

Only used when mode = 'domains'. Enter breached domains (e.g. adobe.com, linkedin.com) or HIBP breach names/titles (e.g. Adobe, Collection1). Matching is case-insensitive and a bare brand like 'adobe' also matches 'adobe.com'.

## `minPwnCount` (type: `integer`):

Skip breaches with fewer compromised accounts than this. Use e.g. 1000000 to keep only breaches affecting at least one million accounts. 0 disables the filter.

## `dataClassFilter` (type: `string`):

Keep only breaches that leaked a given class of data. Case-insensitive substring match against the breach's data classes, e.g. 'Passwords', 'Credit cards', 'Physical addresses', 'Phone numbers'. Leave empty to keep all breaches.

## `verifiedOnly` (type: `boolean`):

When enabled, only breaches that HaveIBeenPwned has verified as legitimate are returned. Unverified and fabricated dumps are skipped.

## `maxItems` (type: `integer`):

Hard cap on how many breach records are pushed to the dataset. Results are ordered by affected account count (largest first), so a low value returns the biggest breaches. Maximum 2000.

## Actor input object example

```json
{
  "mode": "all",
  "domains": [
    "adobe.com",
    "linkedin.com"
  ],
  "minPwnCount": 0,
  "dataClassFilter": "Passwords",
  "verifiedOnly": false,
  "maxItems": 500
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "adobe.com",
        "linkedin.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("ninhothedev/data-breach-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "adobe.com",
        "linkedin.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("ninhothedev/data-breach-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "adobe.com",
    "linkedin.com"
  ]
}' |
apify call ninhothedev/data-breach-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=ninhothedev/data-breach-scraper",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/acts/C1orV0RU3dXHLslJU/builds/KTRbmA0okO7Mc7anM/openapi.json