# Email Data Breach Checker — Leak & Credential Exposure Lookup (`ntriqpro/email-data-breach-checker`) Actor

Check email addresses against known data breaches: one row per incident with date, breached domain, industry, records and the categories of data exposed, plus a per-email risk summary. Passwords and hashes are never returned. Data by XposedOrNot; unofficial, not affiliated.

- **URL**: https://apify.com/ntriqpro/email-data-breach-checker.md
- **Developed by:** [daehwan kim](https://apify.com/ntriqpro) (community)
- **Categories:** Developer tools, Lead generation, Automation
- **Stats:** 3 total users, 0 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Email Data Breach Checker — Leak & Credential Exposure Lookup

Give it a list of email addresses. Get back **which data breaches each address turned up in, when they happened, who was breached, and what kind of information was exposed** — one row per incident, plus a one-line risk verdict per address.

Built for security teams, IT support, fraud analysts and anyone auditing the accounts they are responsible for.

### What you never get back

**This Actor does not return exposed passwords or password hashes. Ever.**

It reports the *categories* of data an incident exposed — "this breach exposed passwords, names and phone numbers" — and how well those passwords were protected, as a plain-language label. The values themselves are never fetched, never stored and never written to your dataset. Three independent guards in the code enforce this, including a final pattern scan on every finished row.

That is a deliberate product decision, not a limitation. You get what you need to act — *rotate the credentials on these six services* — without handling a single live secret.

### What you get

**One row per breach incident** (`rowType: "breach"`):

| Field | Example |
|---|---|
| `breachName` | `Addi` |
| `breachedDate` / `breachedYear` | `2026-03-01` / `2026` |
| `breachedDomain` | `addi.com` |
| `industry` | `Finance` |
| `breachType` | `DataBreach` |
| `severity` | `critical` / `high` / `medium` / `low` |
| `exposedDataTypes` | `["Email addresses","Names","Government issued IDs","IP addresses","Phone numbers","Physical addresses","Purchases"]` |
| `exposedDataCount` | `7` |
| `exposedRecords` | `25934104` |
| `verified` / `sensitive` / `searchable` | `true` / `false` / `true` |
| `passwordProtection` | `Passwords were stored with weak protection` |
| `description` | Plain-language account of the incident |
| `referenceUrl` / `logoUrl` | Public reference for the incident |
| `headline` | `you@example.com was in the Addi breach (2026), 25,934,104 records — critical severity; exposed: Email addresses, Names, Government issued IDs, IP addresses +3 more` |

**One summary row per address** (`rowType: "summary"`) — read this first:

```
headline: "you@example.com appears in 208 known breaches — risk Critical,
           most recent BrinksHome (2026); 142 exposed credential data;
           7,214,439,136 records across all incidents"
```

It also carries `breachCount`, `riskLabel`, `riskScore`, the severity breakdown (`criticalBreaches`, `highBreaches`, `mediumBreaches`, `lowBreaches`), `breachesExposingCredentials`, `verifiedBreaches`, `totalRecordsExposed`, `firstBreachYear`, `latestBreachYear`, `latestBreachName`, `topExposedDataTypes` (ranked with counts), `pasteAppearances` and a `recommendedAction`.

**Severity** is our own verdict, not the source's: an incident that leaked credentials, financial data or government identifiers ranks `critical`; contact and location data ranks `high` or `medium` depending on the size of the incident; everything else is `low`. Rows come back most severe first, so a capped run still shows you the incidents that matter.

### Input

```json
{
  "emails": ["alice@example.com", "bob@example.com"],
  "maxBreachesPerEmail": 100,
  "minSeverity": "all",
  "includeSummaryRow": true,
  "enrichWithCatalog": true,
  "maxResults": 2000,
  "maxRunSecs": 900
}
```

| Field | Default | Notes |
|---|---|---|
| `emails` | — | Required. Up to **500 addresses per run**. Duplicates and malformed values are dropped and never charged. |
| `maxBreachesPerEmail` | `100` | 1–500. Heavily exposed addresses appear in 200+ incidents; this keeps a batch predictable. Highest severity kept first. |
| `minSeverity` | `all` | `all` / `medium` / `high` / `critical`. |
| `includeSummaryRow` | `true` | The per-address verdict row. |
| `enrichWithCatalog` | `true` | One extra request per run adds the exact breach date, breach type and reference URL to every row. Free of charge. |
| `maxResults` | `2000` | Billable row ceiling for the whole run (max 20000). |
| `maxRunSecs` | `900` | Soft deadline; the run finishes successfully with whatever it has collected. |

### Pricing

Pay-per-event. You are charged for the rows you receive:

| Event | What it covers |
|---|---|
| `actor-start` | Run setup and the breach-catalog lookup that enriches every row. |
| `breach-record` | One breach incident row. |
| `email-summary` | One per-address summary row. |

Fan-out varies by address: a lightly exposed address typically returns a handful of incidents, a long-lived one can return 200+. Use `maxBreachesPerEmail` and `minSeverity` to size a run before you scale it up.

**Not charged:** addresses that turn out to be clean, malformed inputs, and every status or notice row. If we could not produce a result for an address, you do not pay for that address.

### Free plan

Free-plan runs return up to **25 result rows**, chosen by value rather than by order: every summary verdict first, then the most severe breaches. The run finishes successfully with a notice explaining the cap — it is never an error. Upgrade your Apify plan to receive every row.

### Notice rows

Runs can include non-billable `rowType: "notice"` rows: `no-breach-found` (address is clean), `invalid-emails-skipped`, `lookup-failed`, `rate-limited`, `free-plan-cap`, `charge-limit-reached`, `time-budget-reached`.

Invalid input ends the run as SUCCEEDED with a notice row.

### Responsible use

- **Check addresses you own or are authorised to investigate.** This Actor exists to help people find and close their own exposure. Using it to profile, harass, intimidate or extort anyone is prohibited, as is any use that breaks the law that applies to you.
- **You are the data controller** for the addresses you submit and the results you receive. Handling them lawfully — GDPR, CCPA and any local equivalent — is your responsibility, including your lawful basis for processing and your retention policy.
- Results describe **historical incidents at third-party companies**. An address appearing in a breach says nothing about the person behind it.

### Data source

Breach data is provided by **[XposedOrNot](https://xposedornot.com)**, an open breach-intelligence project. Every row carries `dataSource` and `dataSourceUrl` fields crediting it.

This is an **unofficial** tool. It is not affiliated with, endorsed by or sponsored by XposedOrNot or any breached company named in the results. Coverage is limited to incidents indexed by the source: an address with no rows means "not found in the indexed breaches", not "never breached". Incident descriptions, dates and record counts are reproduced from the source and are not independently verified by us.

# Actor input Schema

## `emails` (type: `array`):

One or more email addresses to check against known data breaches. Each address returns one row per breach incident it appears in (typically 5-30, sometimes 200+) plus a risk summary row. Max 500 addresses per run. Only check addresses you own or are authorised to investigate.

## `maxBreachesPerEmail` (type: `integer`):

Cap on breach rows returned for a single address, highest severity first. Heavily exposed addresses can appear in 200+ incidents; this keeps a large batch predictable. 1-500.

## `minSeverity` (type: `string`):

Return only breaches at or above this severity. Severity is derived from the categories of data exposed (credentials and financial or government identifiers rank highest) and the size of the incident.

## `includeSummaryRow` (type: `boolean`):

On by default: adds one row per address with total breach count, overall risk label, most recent incident, total records exposed and a one-line headline verdict you can read at a glance.

## `enrichWithCatalog` (type: `boolean`):

On by default: fetches the full breach catalog once per run to add the exact breach date, breach type and public reference URL to every row. Costs one extra request for the whole run and is free of charge.

## `maxResults` (type: `integer`):

Stop after this many billable rows (all row types combined). 1-20000.

## `maxRunSecs` (type: `integer`):

Soft deadline for the whole run. When reached, the run stops looking up further addresses and returns everything collected so far as a successful run. 60-21600.

## Actor input object example

```json
{
  "emails": [
    "test@example.com"
  ],
  "maxBreachesPerEmail": 100,
  "minSeverity": "all",
  "includeSummaryRow": true,
  "enrichWithCatalog": true,
  "maxResults": 2000,
  "maxRunSecs": 900
}
```

# Actor output Schema

## `dataset` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "emails": [
        "test@example.com"
    ],
    "maxBreachesPerEmail": 100,
    "includeSummaryRow": true,
    "enrichWithCatalog": true,
    "maxResults": 2000,
    "maxRunSecs": 900
};

// Run the Actor and wait for it to finish
const run = await client.actor("ntriqpro/email-data-breach-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "emails": ["test@example.com"],
    "maxBreachesPerEmail": 100,
    "includeSummaryRow": True,
    "enrichWithCatalog": True,
    "maxResults": 2000,
    "maxRunSecs": 900,
}

# Run the Actor and wait for it to finish
run = client.actor("ntriqpro/email-data-breach-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "emails": [
    "test@example.com"
  ],
  "maxBreachesPerEmail": 100,
  "includeSummaryRow": true,
  "enrichWithCatalog": true,
  "maxResults": 2000,
  "maxRunSecs": 900
}' |
apify call ntriqpro/email-data-breach-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,ntriqpro/email-data-breach-checker"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/1lhHf3rNfG0RfdySW/builds/5j3ZX1xKrujbX6Brq/openapi.json