Email Data Breach Checker — Leak & Credential Exposure Lookup

Give it a list of email addresses. Get back which data breaches each address turned up in, when they happened, who was breached, and what kind of information was exposed — one row per incident, plus a one-line risk verdict per address.

Built for security teams, IT support, fraud analysts and anyone auditing the accounts they are responsible for.

What you never get back

This Actor does not return exposed passwords or password hashes. Ever.

It reports the categories of data an incident exposed — "this breach exposed passwords, names and phone numbers" — and how well those passwords were protected, as a plain-language label. The values themselves are never fetched, never stored and never written to your dataset. Three independent guards in the code enforce this, including a final pattern scan on every finished row.

That is a deliberate product decision, not a limitation. You get what you need to act — rotate the credentials on these six services — without handling a single live secret.

What you get

One row per breach incident (rowType: "breach"):

Field	Example
breachName	Addi
breachedDate / breachedYear	2026-03-01 / 2026
breachedDomain	addi.com
industry	Finance
breachType	DataBreach
severity	critical / high / medium / low
exposedDataTypes	["Email addresses","Names","Government issued IDs","IP addresses","Phone numbers","Physical addresses","Purchases"]
exposedDataCount	7
exposedRecords	25934104
verified / sensitive / searchable	true / false / true
passwordProtection	Passwords were stored with weak protection
description	Plain-language account of the incident
referenceUrl / logoUrl	Public reference for the incident
headline	you@example.com was in the Addi breach (2026), 25,934,104 records — critical severity; exposed: Email addresses, Names, Government issued IDs, IP addresses +3 more

One summary row per address (rowType: "summary") — read this first:

headline: "you@example.com appears in 208 known breaches — risk Critical,
           most recent BrinksHome (2026); 142 exposed credential data;
           7,214,439,136 records across all incidents"

It also carries breachCount, riskLabel, riskScore, the severity breakdown (criticalBreaches, highBreaches, mediumBreaches, lowBreaches), breachesExposingCredentials, verifiedBreaches, totalRecordsExposed, firstBreachYear, latestBreachYear, latestBreachName, topExposedDataTypes (ranked with counts), pasteAppearances and a recommendedAction.

Severity is our own verdict, not the source's: an incident that leaked credentials, financial data or government identifiers ranks critical; contact and location data ranks high or medium depending on the size of the incident; everything else is low. Rows come back most severe first, so a capped run still shows you the incidents that matter.

Input

{
  "emails": ["alice@example.com", "bob@example.com"],
  "maxBreachesPerEmail": 100,
  "minSeverity": "all",
  "includeSummaryRow": true,
  "enrichWithCatalog": true,
  "maxResults": 2000,
  "maxRunSecs": 900
}

Field	Default	Notes
emails	—	Required. Up to 500 addresses per run. Duplicates and malformed values are dropped and never charged.
maxBreachesPerEmail	100	1–500. Heavily exposed addresses appear in 200+ incidents; this keeps a batch predictable. Highest severity kept first.
minSeverity	all	all / medium / high / critical.
includeSummaryRow	true	The per-address verdict row.
enrichWithCatalog	true	One extra request per run adds the exact breach date, breach type and reference URL to every row. Free of charge.
maxResults	2000	Billable row ceiling for the whole run (max 20000).
maxRunSecs	900	Soft deadline; the run finishes successfully with whatever it has collected.

Pricing

Pay-per-event. You are charged for the rows you receive:

Event	What it covers
actor-start	Run setup and the breach-catalog lookup that enriches every row.
breach-record	One breach incident row.
email-summary	One per-address summary row.

Fan-out varies by address: a lightly exposed address typically returns a handful of incidents, a long-lived one can return 200+. Use maxBreachesPerEmail and minSeverity to size a run before you scale it up.

Not charged: addresses that turn out to be clean, malformed inputs, and every status or notice row. If we could not produce a result for an address, you do not pay for that address.

Free plan

Free-plan runs return up to 25 result rows, chosen by value rather than by order: every summary verdict first, then the most severe breaches. The run finishes successfully with a notice explaining the cap — it is never an error. Upgrade your Apify plan to receive every row.

Notice rows

Runs can include non-billable rowType: "notice" rows: no-breach-found (address is clean), invalid-emails-skipped, lookup-failed, rate-limited, free-plan-cap, charge-limit-reached, time-budget-reached.

Invalid input ends the run as SUCCEEDED with a notice row.

Responsible use

• Check addresses you own or are authorised to investigate. This Actor exists to help people find and close their own exposure. Using it to profile, harass, intimidate or extort anyone is prohibited, as is any use that breaks the law that applies to you.
• You are the data controller for the addresses you submit and the results you receive. Handling them lawfully — GDPR, CCPA and any local equivalent — is your responsibility, including your lawful basis for processing and your retention policy.
• Results describe historical incidents at third-party companies. An address appearing in a breach says nothing about the person behind it.

Data source

Breach data is provided by XposedOrNot, an open breach-intelligence project. Every row carries dataSource and dataSourceUrl fields crediting it.

This is an unofficial tool. It is not affiliated with, endorsed by or sponsored by XposedOrNot or any breached company named in the results. Coverage is limited to incidents indexed by the source: an address with no rows means "not found in the indexed breaches", not "never breached". Incident descriptions, dates and record counts are reproduced from the source and are not independently verified by us.